deploy.yml

name: Deploy to VPS

on:
  push:
    branches: [master]
  workflow_dispatch:

# One deploy at a time; let an in-progress deploy finish.
concurrency:
  group: vps-deploy
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger remote deploy over SSH (forced-command key)
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
        run: |
          set -euo pipefail
          if [ -z "${DEPLOY_SSH_KEY:-}" ] || [ -z "${DEPLOY_HOST:-}" ]; then
            echo "::error::DEPLOY_SSH_KEY / DEPLOY_HOST secrets are not set"
            exit 1
          fi
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_deploy
          chmod 600 ~/.ssh/id_deploy
          host="${DEPLOY_HOST##*@}"
          ssh-keyscan -H "$host" >> ~/.ssh/known_hosts 2>/dev/null
          # The server key is restricted to a forced command, so the argument
          # below is ignored — the server always runs /usr/local/bin/trophy-deploy.
          ssh -i ~/.ssh/id_deploy -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes "$DEPLOY_HOST" deploy