ci(deploy): auto-deploy prod stack after image build on merge to main #63

wtclaude · 2026-07-17T10:06:14Z

wtclaude commented

2026-07-17 10:06:14 +00:00

What

Adds a deploy job to .gitea/workflows/build-images.yml so that every merge to main builds the images and rolls production onto them.

How

Two jobs now run in sequence in the same workflow:

build (ubuntu-latest) — builds & pushes website-app / website-bot images (unchanged).
deploy (uom_deploy) — new. needs: build, so it only starts after a clean build+push. On the production host it runs:
```
cd /home/perry/website
docker compose pull
docker compose down
docker compose up -d
docker compose ps
```
It deploys the :latest images (docker-compose.yml defaults IMAGE_TAG=latest).

Behavior / safety

needs: build means a failed build never tears down the running stack — deploy simply doesn't fire.
Guarded with if: github.ref == 'refs/heads/main' so a workflow_dispatch off another branch can't deploy to prod.
pull → down → up -d sequence (down included by request). Compose only recreates services whose image digest changed, so the DB stays put.

Prerequisite (one-time)

A second self-hosted runner labelled uom_deploy must live on the production host, with access to the Docker daemon and to /home/perry/website (the dir holding the prod docker-compose.yml + .env). Registry auth is already handled on the host, so no docker login step is needed in the job.

Follow-up (optional, not in this PR)

Old sha-<7> images accumulate on the host over time; a docker image prune -f could be added to the deploy job later if disk creep becomes an issue.

🤖 Generated with Claude Code

## What Adds a `deploy` job to `.gitea/workflows/build-images.yml` so that every merge to `main` builds the images **and** rolls production onto them. ## How Two jobs now run in sequence in the same workflow: - **build** (`ubuntu-latest`) — builds & pushes `website-app` / `website-bot` images (unchanged). - **deploy** (`uom_deploy`) — new. `needs: build`, so it only starts after a clean build+push. On the production host it runs: ``` cd /home/perry/website docker compose pull docker compose down docker compose up -d docker compose ps ``` It deploys the `:latest` images (`docker-compose.yml` defaults `IMAGE_TAG=latest`). ## Behavior / safety - `needs: build` means a failed build never tears down the running stack — deploy simply doesn't fire. - Guarded with `if: github.ref == 'refs/heads/main'` so a `workflow_dispatch` off another branch can't deploy to prod. - `pull → down → up -d` sequence (down included by request). Compose only recreates services whose image digest changed, so the DB stays put. ## Prerequisite (one-time) A second self-hosted runner labelled **`uom_deploy`** must live on the production host, with access to the Docker daemon and to `/home/perry/website` (the dir holding the prod `docker-compose.yml` + `.env`). Registry auth is already handled on the host, so no `docker login` step is needed in the job. ## Follow-up (optional, not in this PR) Old `sha-<7>` images accumulate on the host over time; a `docker image prune -f` could be added to the deploy job later if disk creep becomes an issue. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

wtclaude added 1 commit 2026-07-17 10:06:17 +00:00

ci(deploy): auto-deploy prod stack after image build on merge to main

PR Checks / server-tests (pull_request) Successful in 10m20s

Details

PR Checks / bot-install (pull_request) Successful in 9m39s

Details

PR Checks / client-build (pull_request) Successful in 13m0s

Details

97d95052db

Add a `deploy` job to build-images.yml that runs on the self-hosted
`uom_deploy` runner and, via `needs: build`, fires only after a clean
image build+push. It pulls the fresh :latest images and recreates the
stack (pull → down → up -d) from /home/perry/website. Guarded on
refs/heads/main so a workflow_dispatch off another branch can't deploy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

whitlocktech approved these changes 2026-07-17 10:07:56 +00:00

whitlocktech scheduled this pull request to auto merge when all checks succeed 2026-07-17 10:24:22 +00:00

whitlocktech merged commit 49ad6891cf into main

2026-07-17 10:29:06 +00:00

whitlocktech deleted branch ci/auto-deploy-on-merge

2026-07-17 10:29:06 +00:00

whitlocktech referenced this issue from a commit

2026-07-17 10:29:07 +00:00

Merge pull request 'ci(deploy): auto-deploy prod stack after image build on merge to main' (#63) from ci/auto-deploy-on-merge into main

wtclaude referenced this pull request

2026-07-17 10:32:21 +00:00

ci(deploy): correct deploy runner label to uom-deploy-runner #64