0008 — GitHub Actions → GHCR → pull-based deploy

Status: reconstructed — needs confirmation

Context

Deploys were manual (rsync + build on the server). The VPS has 1 vCPU; building images there required 4 GB of swap and blocked the box.

Decision

Per-component GitHub Actions workflows (.github/workflows/deploy-*.yml) build images with Buildx (GHA cache), push latest + sha-<short> tags to ghcr.io/aimgoldorg/*, then SSH into the VPS and run docker compose pull + up -d --no-build for just the affected services, followed by an HTTPS health check pinned to the VPS with curl --resolve. Deploy scripts are serialized server-side with flock and fail fast (set -e). All workflows also expose workflow_dispatch, which the admin portal's Build Tools page triggers through the admin-api devops module.

Consequences

• The server never builds; deploys are minutes and reproducible.
• Rollback = pin API_IMAGE_TAG/WEBSITE_IMAGE_TAG/ADMIN_PORTAL_IMAGE_TAG to a previous sha- tag and re-run up -d --no-build.
• Requires two credentials with small blast radius: a repo-scoped SSH deploy key (repo secret VPS_SSH_KEY) and a read:packages PAT for registry pulls on the server.