ci: auto-deploy main → prod (GHCR build + pull-deploy on gerty)

[dotMavriQ]

What

Continuous deployment to teal.dotmavriq.life on every push to main, gated on the existing quality + tests jobs. Image is built in CI and pulled on gerty (gerty's 1-core/2 GB box never builds).

Flow

push main → quality + tests green → build image → push ghcr.io/dotmavriq/teal:<sha>
          → ssh gerty → backup DB → migrate-guard → pull → restart app+queue → health-gate

🛡️ Data protection (prime directive)

The prod Postgres data lives in the named volume teal-db-data, separate from the app image. docker/deploy-prod.sh:

• acts on app + queue only, by explicit name — never touches the db service or its volume
• forbidden: down, down -v, volume rm, --renew-anon-volumes
• no backup = no deploy: a verified (gzip -t + table-presence) pg_dump runs before anything goes live; rotates last 10
• destructive-migration guard: renders pending migration SQL via migrate --pretend and HALTS on DROP TABLE/COLUMN, TRUNCATE, DELETE FROM (additive migrations auto-apply)
• health-gated: rolls back to the previous image if the new teal-app fails its health check

Secrets

.env / .env.production stay only on gerty (the image carries no secrets). CI needs repo secrets GERTY_HOST, GERTY_USER, GERTY_SSH_KEY (set out-of-band) and the built-in GITHUB_TOKEN for GHCR.

Notes

• The app/queue build: blocks become image:. Local/dev builds use docker-compose.dev.yml.
• First merge to main triggers the first deploy (ships the current main; ~65 commits ahead of what's live). Will be babysat.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Enhanced production deployment automation with safety checks including pre-deployment validation, automatic backups, and rollback capabilities.
  • Updated deployment infrastructure to use pre-built container images for faster, more consistent deployments.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Note

.coderabbit.yaml has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized key: "tools"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

📝 Walkthrough

Walkthrough

The PR establishes a CI/CD pipeline for automated production deployment. A GitHub Actions workflow builds and pushes Docker images to GHCR on push to main. Docker Compose is reconfigured to deploy prebuilt images instead of building locally. A new deploy script orchestrates safe remote deployment with database backup, migration safety checks, health monitoring, and automated rollback on failure.

Changes

Automated Production Deployment Pipeline

Layer / File(s)	Summary
CI Build & Push to GHCR .github/workflows/tests.yml	New build-and-deploy job triggers on push to main after tests pass, builds the production Docker image, pushes to GHCR with SHA and latest tags, then SSH deploys using the deploy script with TEAL_TAG set to the commit SHA.
Docker Compose Image Configuration docker-compose.yml	app and queue services switch from local builds to image references using ${TEAL_IMAGE}:${TEAL_TAG}. app service adds read-only .env mount with clarifying comments on secret handling vs. image build separation.
Deploy Script Initialization & Guards docker/deploy-prod.sh	Script sets strict error handling, defines config and logging helpers, validates project directory, enforces input guards against destructive teardown commands, and pre-flight-checks required files, Docker network, and teal-db health.
Backup, Safety Checks & Live Deployment docker/deploy-prod.sh	Captures current image for rollback, creates timestamped gzipped database backups with integrity checks and schema validation, pulls new image, runs migrations in pretend mode to scan for destructive SQL patterns (DROP/TRUNCATE/DELETE), then brings up app + queue with the new image while preserving the database.
Health Monitoring & Automated Rollback docker/deploy-prod.sh	Polls teal-app health status until healthy or timeout, prunes unused images on success. On failure, rolls back to the previous image if it matches GHCR repository prefix; otherwise aborts with instructions while preserving the database and backup.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🚀 From source code to the cloud it flies,
With tests that pass and images rise,
Backups stand guard, migrations beware,
Health checks confirm—then rollback's there!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly captures the main change: adding CI-driven auto-deployment to production when pushing to main, building and pushing images to GHCR, then deploying on the gerty host.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/auto-deploy-prod

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}