fix(ci): ssh-keyscan failure no longer fails the deploy
ssh-keyscan was being called with set -e in effect and stderr suppressed, so a single keyscan failure killed the entire deploy with no diagnostic output. Since rsync/ssh use StrictHostKeyChecking=no, the known_hosts entry is not load-bearing — making the keyscan best-effort is safe. stderr is now captured to /tmp/keyscan.err and emitted as a warning so future failures are debuggable. Agent-Session: cowork-deploy-fix-20260414
This commit is contained in:
peptiderepo
183
.github/workflows/deploy.yml
vendored
183
.github/workflows/deploy.yml
vendored
@@ -1,90 +1,95 @@
|
|||||||
name: Deploy Theme to Hostinger
|
name: Deploy Theme to Hostinger
|
||||||
|
|
||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
branches: [main]
|
branches: [main]
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
validate:
|
validate:
|
||||||
name: Validate PHP & JS
|
name: Validate PHP & JS
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout code
|
- name: Checkout code
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
- name: PHP Lint Check
|
- name: PHP Lint Check
|
||||||
run: |
|
run: |
|
||||||
find . -name "*.php" -not -path "./vendor/*" -not -path "./node_modules/*" -exec php -l {} \; | (grep -v "No syntax errors" || true) | head -20
|
find . -name "*.php" -not -path "./vendor/*" -not -path "./node_modules/*" -exec php -l {} \; | (grep -v "No syntax errors" || true) | head -20
|
||||||
test ${PIPESTATUS[0]} -eq 0
|
test ${PIPESTATUS[0]} -eq 0
|
||||||
|
|
||||||
- name: Install PHPCS with WordPress standards
|
- name: Install PHPCS with WordPress standards
|
||||||
run: |
|
run: |
|
||||||
composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
|
composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
|
||||||
composer global require --dev squizlabs/php_codesniffer:"^3.0" wp-coding-standards/wpcs:"^3.0" phpcsstandards/phpcsutils:"^1.0"
|
composer global require --dev squizlabs/php_codesniffer:"^3.0" wp-coding-standards/wpcs:"^3.0" phpcsstandards/phpcsutils:"^1.0"
|
||||||
|
|
||||||
- name: Run PHPCS (WordPress Core)
|
- name: Run PHPCS (WordPress Core)
|
||||||
run: |
|
run: |
|
||||||
~/.composer/vendor/bin/phpcs -s .
|
~/.composer/vendor/bin/phpcs -s .
|
||||||
|
|
||||||
- name: JS Syntax Check
|
- name: JS Syntax Check
|
||||||
run: |
|
run: |
|
||||||
find assets/js -name "*.js" -exec node --check {} \;
|
find assets/js -name "*.js" -exec node --check {} \;
|
||||||
|
|
||||||
deploy:
|
deploy:
|
||||||
needs: validate
|
needs: validate
|
||||||
name: Deploy to Production
|
name: Deploy to Production
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout code
|
- name: Checkout code
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
- name: Setup SSH key
|
- name: Setup SSH key
|
||||||
run: |
|
run: |
|
||||||
mkdir -p ~/.ssh
|
mkdir -p ~/.ssh
|
||||||
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
|
||||||
chmod 600 ~/.ssh/deploy_key
|
chmod 600 ~/.ssh/deploy_key
|
||||||
ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
|
# Best-effort: keyscan stderr captured for diagnosis but never fatal.
|
||||||
|
# We use StrictHostKeyChecking=no on the actual ssh/rsync calls anyway.
|
||||||
- name: Deploy via rsync
|
ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/tmp/keyscan.err || {
|
||||||
run: |
|
echo "::warning::ssh-keyscan failed (non-fatal). stderr:"
|
||||||
rsync -avz --delete \
|
cat /tmp/keyscan.err || true
|
||||||
--exclude='.git' \
|
}
|
||||||
--exclude='.github' \
|
|
||||||
--exclude='tests/' \
|
- name: Deploy via rsync
|
||||||
--exclude='phpunit.xml' \
|
run: |
|
||||||
--exclude='composer.json' \
|
rsync -avz --delete \
|
||||||
--exclude='composer.lock' \
|
--exclude='.git' \
|
||||||
--exclude='vendor/' \
|
--exclude='.github' \
|
||||||
--exclude='node_modules/' \
|
--exclude='tests/' \
|
||||||
--exclude='.phpcs.xml.dist' \
|
--exclude='phpunit.xml' \
|
||||||
-e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=no" \
|
--exclude='composer.json' \
|
||||||
./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/themes/peptide-starter/
|
--exclude='composer.lock' \
|
||||||
|
--exclude='vendor/' \
|
||||||
- name: Purge LiteSpeed Cache
|
--exclude='node_modules/' \
|
||||||
run: |
|
--exclude='.phpcs.xml.dist' \
|
||||||
ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=no \
|
-e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=no" \
|
||||||
${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
|
./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/themes/peptide-starter/
|
||||||
CACHE_DIR="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/litespeed"
|
|
||||||
if [ -d "$CACHE_DIR" ]; then
|
- name: Purge LiteSpeed Cache
|
||||||
rm -rf "$CACHE_DIR"/*
|
run: |
|
||||||
echo "LiteSpeed cache purged."
|
ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=no \
|
||||||
fi
|
${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
|
||||||
touch "/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/.lscache_purge" 2>/dev/null || true
|
CACHE_DIR="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/litespeed"
|
||||||
echo "Cache purge signal sent."
|
if [ -d "$CACHE_DIR" ]; then
|
||||||
ENDSSH
|
rm -rf "$CACHE_DIR"/*
|
||||||
|
echo "LiteSpeed cache purged."
|
||||||
- name: Cleanup
|
fi
|
||||||
if: always()
|
touch "/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/.lscache_purge" 2>/dev/null || true
|
||||||
run: rm -f ~/.ssh/deploy_key
|
echo "Cache purge signal sent."
|
||||||
|
ENDSSH
|
||||||
- name: Health check
|
|
||||||
run: |
|
- name: Cleanup
|
||||||
sleep 5
|
if: always()
|
||||||
STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com)
|
run: rm -f ~/.ssh/deploy_key
|
||||||
if [ "$STATUS" != "200" ]; then
|
|
||||||
echo "WARNING: Site returned HTTP $STATUS after deploy"
|
- name: Health check
|
||||||
exit 1
|
run: |
|
||||||
fi
|
sleep 5
|
||||||
|
STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com)
|
||||||
|
if [ "$STATUS" != "200" ]; then
|
||||||
|
echo "WARNING: Site returned HTTP $STATUS after deploy"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
echo "Site is healthy (HTTP 200)"
|
echo "Site is healthy (HTTP 200)"
|
||||||
Reference in New Issue
Block a user