Repository navigation
fix(sns): tls-check gates on the host-routing pointer (SOL then TXT) #33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & Push to GHCR | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=tag | |
| type=sha,prefix=sha-,format=short | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Deploy to iqlabs-prod-01 | |
| # The server's authorized_keys is command-restricted to deploy.sh iq-gateway, | |
| # so even if DEPLOY_SSH_KEY leaks it can only redeploy this one service. | |
| # Host key pinned to SSH_HOST_KEY (full pubkey line) to prevent MITM. | |
| if: github.ref == 'refs/heads/main' && success() | |
| env: | |
| DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} | |
| DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }} | |
| SSH_HOST_KEY: ${{ secrets.SSH_HOST_KEY }} | |
| run: | | |
| mkdir -p ~/.ssh | |
| umask 077 | |
| printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key | |
| printf '%s %s\n' "$DEPLOY_HOST" "$SSH_HOST_KEY" > ~/.ssh/known_hosts | |
| ssh -i ~/.ssh/deploy_key \ | |
| -o UserKnownHostsFile=~/.ssh/known_hosts \ | |
| -o StrictHostKeyChecking=yes \ | |
| -o BatchMode=yes \ | |
| -o ConnectTimeout=10 \ | |
| iqlabs@"$DEPLOY_HOST" 'this command is ignored due to command restriction' | |
| # Always clean up the key | |
| shred -u ~/.ssh/deploy_key 2>/dev/null || rm -f ~/.ssh/deploy_key |