Merge pull request 'Update actions/checkout digest to 8e8c483' (#22) from renovate/actions-checkout-digest into main

Reviewed-on: #22

.gitea/workflows/hello.yamlx

@@ -1,15 +0,0 @@
-name: Hello world
-
-on:
-  - push
-
-jobs:
-  say-hello:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Print hello
-        run: echo "Hello, world! from Gitea Actions"
-

.gitea/workflows/workflow.yaml

@@ -8,11 +8,17 @@ on:
     types: [opened, synchronize, reopened, closed]
 
 env:
-  REMOTE_DEPLOY_PATH: /tmp/app           # Change to your remote deploy base path
+  # Base path for PR preview environments
+  REMOTE_DEPLOY_PATH: /var/app/test/test
+
+  # --- CUSTOMIZABLE PRODUCTION PATH ---
+  # Set the absolute path for your production deployment on the remote server.
+  REMOTE_PROD_PATH: /var/app/test/test-prod
+
   SSH_HOST: ${{ secrets.SSH_HOST }}
   SSH_USER: ${{ secrets.SSH_USER }}
   SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-  SSH_PORT: ${{ secrets.SSH_PORT || 22 }}    # Default to port 22 if not set
+  SSH_PORT: ${{ secrets.SSH_PORT || 22 }}
 
 jobs:
   prepare_deployment_vars:
@@ -24,14 +30,18 @@ jobs:
       - name: Set deployment variables
         id: set-vars
         run: |
+          REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            DEPLOY_DIR_NAME="pr-${{ github.event.pull_request.number }}"
+            # For PRs, create a unique directory under the base path
+            DEPLOY_PATH="${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}"
           else
-            DEPLOY_DIR_NAME="main"
+            # For 'main' branch, use the specified production path.
+            # Fallback to a default if REMOTE_PROD_PATH is empty.
+            DEPLOY_PATH="${REMOTE_PROD_PATH:-${REMOTE_DEPLOY_PATH}/main}"
           fi
-          echo "DEPLOY_PATH=${REMOTE_DEPLOY_PATH}/${DEPLOY_DIR_NAME}" >> $GITHUB_ENV
+          echo "DEPLOY_PATH=${DEPLOY_PATH}" >> $GITHUB_ENV
-          echo "deploy_path=${REMOTE_DEPLOY_PATH}/${DEPLOY_DIR_NAME}" >> $GITHUB_OUTPUT
+          echo "deploy_path=${DEPLOY_PATH}" >> $GITHUB_OUTPUT
-          echo "DEPLOY_PATH will be: ${REMOTE_DEPLOY_PATH}/${DEPLOY_DIR_NAME}"
+          echo "DEPLOY_PATH will be: ${DEPLOY_PATH}"
 
   create_remote_directory:
     name: Create remote directory
@@ -42,7 +52,7 @@ jobs:
       || github.ref == 'refs/heads/main'
     steps:
       - name: Setup SSH
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
         with:
           ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
@@ -50,7 +60,6 @@ jobs:
         run: |
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
-          echo "Scanning SSH host key for $SSH_HOST:$SSH_PORT..."
           ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
             echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
             exit 1
@@ -58,17 +67,18 @@ jobs:
           chmod 644 ~/.ssh/known_hosts
 
       - name: Create directory on remote
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "mkdir -p ${{ needs.prepare_deployment_vars.outputs.deploy_path }}"
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "mkdir -p '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'"
 
   sync_repo_files:
     name: Sync repository files
     runs-on: ubuntu-latest
-    needs: create_remote_directory
+    needs: [create_remote_directory, prepare_deployment_vars]
     if: |
       (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
       || github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
       - name: Sync files via scp
         uses: appleboy/scp-action@master
@@ -79,22 +89,17 @@ jobs:
           port: ${{ env.SSH_PORT }}
           source: "./"
           target: "${{ needs.prepare_deployment_vars.outputs.deploy_path }}"
-          # The 'exclude' parameter is supported and should be kept
-          exclude: |
-            .git/
-            .github/
-            node_modules/
 
   run_docker_compose:
     name: Run docker-compose remotely
     runs-on: ubuntu-latest
-    needs: sync_repo_files
+    needs: [sync_repo_files, prepare_deployment_vars]
     if: |
       (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
       || github.ref == 'refs/heads/main'
     steps:
       - name: Setup SSH
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
         with:
           ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
@@ -102,7 +107,6 @@ jobs:
         run: |
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
-          echo "Scanning SSH host key for $SSH_HOST:$SSH_PORT..."
           ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
             echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
             exit 1
@@ -110,7 +114,7 @@ jobs:
           chmod 644 ~/.ssh/known_hosts
 
       - name: Run docker-compose on remote host
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd ${{ needs.prepare_deployment_vars.outputs.deploy_path }} && docker-compose up -d --build"
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose up -d --build"
 
   cleanup_mr_environment:
     name: Cleanup MR environment
@@ -121,7 +125,7 @@ jobs:
       (github.event.action == 'closed' || github.event.pull_request.merged == true)
     steps:
       - name: Setup SSH
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
         with:
           ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
@@ -129,13 +133,15 @@ jobs:
         run: |
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
-          echo "Scanning SSH host key for $SSH_HOST:$SSH_PORT..."
           ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
             echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
             exit 1
           }
           chmod 644 ~/.ssh/known_hosts
 
+      - name: Run docker-compose down on remote host
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose down"
+
       - name: Delete deployment directory
         run: |
           ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "if [ -d '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' ]; then rm -rf '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'; echo 'Directory removed.'; else echo 'Directory not found, skipping.'; fi"

docker-compose.yaml

@@ -0,0 +1,8 @@
+version: "3.9"
+services:
+  web:
+    image: nginx:1.27.0-alpine3.19-slim@sha256:a529900d9252ce5d04531a4a594f93736dbbe3ec155a692d10484be82aaa159a
+    ports:
+      - "80"
+    volumes:
+      - ./html:/usr/share/nginx/html:ro

html/index.html

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Helló világ!</title>
+</head>
+<body>
+  <h1>Sziasztok, emberek! 👋</h1>
+  <h2>Másik szöveg</h2>
+</body>
+</html>
+

renovate.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  // "packageRules": [
+  //   {
+  //     "matchCategories": [
+  //       "docker"
+  //     ],
+  //     "pinDigests": true
+  //   }
+  // ],
+  "pinDigests": true
+}