Merge pull request 'Update actions/checkout digest to 8e8c483' (#22) from renovate/actions-checkout-digest into main

Reviewed-on: kovagoadi.hu/static.kovagoadi.hu#22

.gitea/workflows/hello.yamlx

@@ -1,15 +0,0 @@
-name: Hello world
-
-on:
-  - push
-
-jobs:
-  say-hello:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Print hello
-        run: echo "Hello, world! from Gitea Actions"
-

.gitea/workflows/workflow.yaml

@@ -8,11 +8,17 @@ on:
     types: [opened, synchronize, reopened, closed]
 
 env:
-  REMOTE_DEPLOY_PATH: /tmp/app           # Change to your remote deploy base path
+  # Base path for PR preview environments
+  REMOTE_DEPLOY_PATH: /var/app/test/test
+
+  # --- CUSTOMIZABLE PRODUCTION PATH ---
+  # Set the absolute path for your production deployment on the remote server.
+  REMOTE_PROD_PATH: /var/app/test/test-prod
+
   SSH_HOST: ${{ secrets.SSH_HOST }}
   SSH_USER: ${{ secrets.SSH_USER }}
   SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-  SSH_PORT: ${{ secrets.SSH_PORT || 22 }}    # Default to port 22 if not set
+  SSH_PORT: ${{ secrets.SSH_PORT || 22 }}
 
 jobs:
   prepare_deployment_vars:
@@ -24,14 +30,18 @@ jobs:
       - name: Set deployment variables
         id: set-vars
         run: |
+          REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            DEPLOY_DIR_NAME="pr-${{ github.event.pull_request.number }}"
+            # For PRs, create a unique directory under the base path
+            DEPLOY_PATH="${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}"
           else
-            DEPLOY_DIR_NAME="main"
+            # For 'main' branch, use the specified production path.
+            # Fallback to a default if REMOTE_PROD_PATH is empty.
+            DEPLOY_PATH="${REMOTE_PROD_PATH:-${REMOTE_DEPLOY_PATH}/main}"
           fi
-          echo "DEPLOY_PATH=${REMOTE_DEPLOY_PATH}/${DEPLOY_DIR_NAME}" >> $GITHUB_ENV
+          echo "DEPLOY_PATH=${DEPLOY_PATH}" >> $GITHUB_ENV
-          echo "deploy_path=${REMOTE_DEPLOY_PATH}/${DEPLOY_DIR_NAME}" >> $GITHUB_OUTPUT
+          echo "deploy_path=${DEPLOY_PATH}" >> $GITHUB_OUTPUT
-          echo "DEPLOY_PATH will be: ${REMOTE_DEPLOY_PATH}/${DEPLOY_DIR_NAME}"
+          echo "DEPLOY_PATH will be: ${DEPLOY_PATH}"
 
   create_remote_directory:
     name: Create remote directory
@@ -42,7 +52,7 @@ jobs:
       || github.ref == 'refs/heads/main'
     steps:
       - name: Setup SSH
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
         with:
           ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
@@ -50,7 +60,6 @@ jobs:
         run: |
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
-          echo "Scanning SSH host key for $SSH_HOST:$SSH_PORT..."
           ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
             echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
             exit 1
@@ -58,7 +67,7 @@ jobs:
           chmod 644 ~/.ssh/known_hosts
 
       - name: Create directory on remote
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "mkdir -p ${{ needs.prepare_deployment_vars.outputs.deploy_path }}"
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "mkdir -p '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'"
 
   sync_repo_files:
     name: Sync repository files
@@ -68,7 +77,8 @@ jobs:
       (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
       || github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
       - name: Sync files via scp
         uses: appleboy/scp-action@master
@@ -79,12 +89,6 @@ jobs:
           port: ${{ env.SSH_PORT }}
           source: "./"
           target: "${{ needs.prepare_deployment_vars.outputs.deploy_path }}"
-          #target: "/tmp/app/main"
-          # The 'exclude' parameter is supported and should be kept
-          # exclude: |
-          #   .git/
-          #   .github/
-          #   node_modules/
 
   run_docker_compose:
     name: Run docker-compose remotely
@@ -95,7 +99,7 @@ jobs:
       || github.ref == 'refs/heads/main'
     steps:
       - name: Setup SSH
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
         with:
           ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
@@ -103,7 +107,6 @@ jobs:
         run: |
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
-          echo "Scanning SSH host key for $SSH_HOST:$SSH_PORT..."
           ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
             echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
             exit 1
@@ -111,18 +114,18 @@ jobs:
           chmod 644 ~/.ssh/known_hosts
 
       - name: Run docker-compose on remote host
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd ${{ needs.prepare_deployment_vars.outputs.deploy_path }} && docker-compose up -d --build"
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose up -d --build"
 
   cleanup_mr_environment:
     name: Cleanup MR environment
     runs-on: ubuntu-latest
-    needs: [prepare_deployment_vars, prepare_deployment_vars]
+    needs: prepare_deployment_vars
     if: |
       github.event_name == 'pull_request' && 
       (github.event.action == 'closed' || github.event.pull_request.merged == true)
     steps:
       - name: Setup SSH
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
         with:
           ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
@@ -130,13 +133,15 @@ jobs:
         run: |
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
-          echo "Scanning SSH host key for $SSH_HOST:$SSH_PORT..."
           ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
             echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
             exit 1
           }
           chmod 644 ~/.ssh/known_hosts
 
+      - name: Run docker-compose down on remote host
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose down"
+
       - name: Delete deployment directory
         run: |
           ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "if [ -d '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' ]; then rm -rf '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'; echo 'Directory removed.'; else echo 'Directory not found, skipping.'; fi"

asd.txt

@@ -1 +0,0 @@
-Random file, ami remélhetőleg megjelenik

docker-compose.yaml

@@ -1,7 +1,7 @@
 version: "3.9"
 services:
   web:
-    image: nginx:1.26.1-alpine3.19-slim
+    image: nginx:1.27.0-alpine3.19-slim@sha256:a529900d9252ce5d04531a4a594f93736dbbe3ec155a692d10484be82aaa159a
     ports:
       - "80"
     volumes:

renovate.json

@@ -2,5 +2,14 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended"
-  ]
+  ],
+  // "packageRules": [
+  //   {
+  //     "matchCategories": [
+  //       "docker"
+  //     ],
+  //     "pinDigests": true
+  //   }
+  // ],
+  "pinDigests": true
 }