deploy-pipeline

name	deploy-pipeline
description	Manage and verify the ArtStroy CI/CD pipeline. Covers the GitHub Actions deploy workflow, SSH-based Hetzner deployment, Docker Compose orchestration, and post-deploy health checks. Used by DevOps Engineer for deploy operations and pipeline maintenance.

Deploy Pipeline

ArtStroy deploys via GitHub Actions → SSH → Hetzner VPS → Docker Compose. Understanding this pipeline is required for every DevOps task.

Pipeline Overview

git push to master
    ↓
GitHub Actions: .github/workflows/deploy.yml
    ↓
SSH into SERVER_HOST as SERVER_USER (using SSH_DEPLOY_KEY)
    ↓
git pull origin master
    ↓
bun run build          (astro check && astro build)
    ↓
docker compose build
    ↓
docker compose up -d
    ↓
Health check: curl https://artstroy.net → HTTP 200

deploy.yml Structure

Key components to understand and maintain:

on:
  push:
    branches: [master]

jobs:
  deploy:
    steps:
      - name: Deploy to Hetzner
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_DEPLOY_KEY }}
          script: |
            cd /srv/artstroy
            git pull origin master
            bun run build
            docker compose build
            docker compose up -d

Critical invariants:

• bun run build (never npm run build or node)
• docker compose (V2, no hyphen — never docker-compose)
• The deploy path on the server is /srv/artstroy — verify this in key_facts.md

Deploying

Normal deploy (auto-triggered on master push):

• No action needed from DevOps — GitHub Actions handles it
• Monitor: GitHub Actions UI for the deploy job status

Manual deploy (when CI is skipped or testing):

ssh ${SERVER_USER}@${SERVER_HOST} << 'EOF'
cd /srv/artstroy
git pull origin master
bun run build
docker compose build && docker compose up -d
EOF

Post-Deploy Verification

After every deploy, verify:

curl -I https://artstroy.net
# Expected: HTTP/2 200

curl -I https://artstroy.net/sitemap.xml
# Expected: HTTP/2 200

docker compose ps
# Expected: all services "Up"

If the site returns non-200 after 2 minutes:

1. Check docker compose logs for build/runtime errors
2. Check nginx logs for upstream errors
3. Rollback procedure: git revert HEAD && git push origin master (triggers new deploy)

Rollback Procedure

# On server — revert to previous working image
cd /srv/artstroy
git log --oneline -5        # identify last good commit
git checkout {good-commit}  # NOT on master — creates detached HEAD
bun run build
docker compose build && docker compose up -d
# Then create a proper revert commit on master via PR

Always fix forward on master — direct rollback is only for emergencies while the fix PR is being prepared.

Pipeline Maintenance Tasks

• Dependency updates: when chore(deps) PRs are created, verify bun run build passes in CI before merge
• Docker base image updates: update Dockerfile base image tag → rebuild → smoke test
• GitHub Actions runner: if using self-hosted runner, monitor for stale runner state
• Secrets rotation: when SSH_DEPLOY_KEY or other deploy secrets rotate (see secrets-management skill), update GitHub Actions repository secrets immediately and verify a deploy succeeds before considering rotation complete