Conversation
WalkthroughIntroduces a GitHub Actions deployment workflow that connects via SSH to a VPS to run a redeploy script. Adds a server-side redeploy script that pulls latest main, rebuilds Docker services, and performs a health check with retries. Removes an obsolete local data-counting script. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GA as GitHub Actions (Deploy)
participant VPS as VPS (SSH)
participant RS as redeploy-site.sh
participant DC as Docker Compose
participant APP as graphuf container
participant HL as /health endpoint
Dev->>GA: Manual dispatch (or Run Tests success)
GA->>VPS: SSH connect using secrets
GA->>VPS: Execute ~/redeploy-site.sh
VPS->>RS: Start script
RS->>RS: git fetch && reset --hard origin/main
RS->>DC: down
RS->>DC: up -d --build
DC->>APP: (re)create containers
RS->>HL: HEAD https://www.aleguy02.dev/health (retry up to 5)
alt 200 OK
HL-->>RS: 200
RS-->>GA: Success
else Non-200 / timeout
RS-->>GA: Failure (non-zero exit)
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/deploy.yml (1)
36-40: Broken SSH step, wrong order, and tilde won’t expand; also copying from the wrong path
- The two ssh commands are concatenated via backslash (no separator) → invalid shell.
- You run the script before copying it.
- '~' is single-quoted (no expansion on remote).
- Path references a different repo (~/PE-portfolio). Use this repo’s scripts via checkout + scp.
Apply this diff to fix all of the above:
steps: - name: Configure SSH run: | @@ env: SSH_USER: ${{ secrets.SSH_USER }} SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} SSH_IP: ${{ secrets.SSH_IP }} - - name: Redeploy Site - run: | - ssh my-vps '~/redeploy-site.sh' \ - ssh my-vps 'yes | cp ~/PE-portfolio/scripts/redeploy-site.sh ~/redeploy-site.sh' + - name: Checkout repo + uses: actions/checkout@v4 + + - name: Upload and run redeploy script + run: | + scp ./scripts/redeploy-site.sh my-vps:~/redeploy-site.sh + ssh my-vps 'bash -lc "chmod +x $HOME/redeploy-site.sh && $HOME/redeploy-site.sh"'
🧹 Nitpick comments (8)
scripts/redeploy-site.sh (6)
2-2: Drop unrelated virtualenv noteThis script doesn’t use Python; the comment is misleading. Remove or move to README.
-# Set up a virtual environment "python3-virtualenv" before executing this script
4-4: Harden shell optionsEnable -u and ERR trapping to catch unset vars and propagate errors from subshells.
-set -eo pipefail +set -Eeuo pipefail +trap 'echo "error on line $LINENO" >&2' ERR
6-14: Quote paths and parameterize retry sleep
- Quote PROJECT_DIR in cd.
- Add SLEEP_SECONDS for reuse.
PROJECT_DIR="$HOME/graph-uf/" URL="https://www.aleguy02.dev" MAX_RETRIES=5 +SLEEP_SECONDS=7 -echo "=== pulling in latest changes ===" +echo "=== pulling in latest changes ===" -cd $PROJECT_DIR +cd "$PROJECT_DIR" git fetch && git reset origin/main --hard > /dev/null
19-25: Compose flags: remove orphans and always pull base imagesPrevents stale containers and ensures base images are refreshed.
-docker compose -f compose.yaml down > /dev/null +docker compose -f compose.yaml down --remove-orphans > /dev/null @@ -docker compose -f compose.yaml up -d --build > /dev/null +docker compose -f compose.yaml up -d --build --pull always > /dev/null
31-36: Container name check may be brittleThis assumes the container is named exactly “graphuf”. If compose doesn’t set container_name, names are usually project_service_1. Consider checking by service label or via compose ps.
Example (more robust by label):
docker ps --filter "label=com.docker.compose.service=$container" --filter "status=running" --format '{{.Names}}' | grep -qx ".\+"Or:
docker compose -f compose.yaml ps --services --status running | grep -qx "$container"Please confirm the actual container/service name in compose.yaml.
39-57: Make health check resilient and faster to failUse curl’s status-code formatter, follow redirects, and add a per-try timeout. Also reuse SLEEP_SECONDS and log status.
-# Health check with retries -retry_count=0 -while [ $retry_count -lt $MAX_RETRIES ]; do - if [ "$(curl --head $URL/health | awk '/^HTTP/{print $2}')" = "200" ]; then - echo "Health check passed" - break - fi - - retry_count=$((retry_count + 1)) - echo "Health check attempt $retry_count/$MAX_RETRIES failed" - - if [ $retry_count -lt $MAX_RETRIES ]; then - echo "Retrying in 7 seconds..." - sleep 7 - fi -done -if [ $retry_count -eq $MAX_RETRIES ]; then - echo "!! Could not reach the site at $URL/health or received a non-200 HTTP response. !!" - exit 1 -fi +# Health check with retries +retry_count=0 +while [ "$retry_count" -lt "$MAX_RETRIES" ]; do + status="$(curl -fsSLI -o /dev/null -w '%{http_code}' -L --max-time 5 "$URL/health" || true)" + if [ "$status" = "200" ]; then + echo "Health check passed" + break + fi + + retry_count=$((retry_count + 1)) + echo "Health check attempt $retry_count/$MAX_RETRIES failed (status: ${status:-curl-error})" + + if [ "$retry_count" -lt "$MAX_RETRIES" ]; then + echo "Retrying in ${SLEEP_SECONDS}s..." + sleep "$SLEEP_SECONDS" + fi +done +if [ "$retry_count" -eq "$MAX_RETRIES" ]; then + echo "!! Could not reach $URL/health or received a non-200 response. !!" + exit 1 +fi.github/workflows/deploy.yml (2)
25-30: Avoid disabling StrictHostKeyChecking in productionPrefer pinning the host key to mitigate MITM risk.
Minimal change:
- StrictHostKeyChecking no + StrictHostKeyChecking yes + UserKnownHostsFile ~/.ssh/known_hostsThen add a one-time key scan in Configure SSH:
run: | mkdir -p ~/.ssh/ echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy-key.pem chmod 600 ~/.ssh/deploy-key.pem + ssh-keyscan -H "$SSH_IP" >> ~/.ssh/known_hosts
11-16: Optional: add job-level concurrency to prevent overlapping deploysPrevents race conditions when multiple runs target the same host.
deploy: + concurrency: + group: deploy-${{ github.ref_name }} + cancel-in-progress: true
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
.github/workflows/deploy.yml(1 hunks)scripts/count_data_points_before_cleaning copy.sh(0 hunks)scripts/redeploy-site.sh(1 hunks)
💤 Files with no reviewable changes (1)
- scripts/count_data_points_before_cleaning copy.sh
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/deploy.yml
37-37: shellcheck reported issue in this script: SC2088:warning:1:12: Tilde does not expand in quotes. Use $HOME
(shellcheck)
Merge pull request #44 from aleguy02/github-actions
1 participant
@coderabbitai ignore
Summary by CodeRabbit