Deploying Applications with GitHub Actions

# CHAPTER 8

Deploying Applications with GitHub Actions #

1. Introduction #

2. Learning Objectives #

• Understand the transition from Continuous Integration to Continuous Deployment.

• Configure multiple jobs within a single workflow using the needs keyword.

• Utilize Marketplace Actions to securely transfer files via SSH/SCP.

• Execute remote commands (like restarting web servers) on a production machine.

• Understand the risks associated with deployment automation.

3. Beginner-Friendly Explanation #

• Job 1 (The CI Check): The engineers run system checks on the rocket. Is the fuel tank sealed? (Unit Tests). If the checks fail, the launch is aborted.

• The Dependency (needs:): The Launch sequence CANNOT start until the System Checks are 100% complete and successful.

• Job 2 (The CD Deployment): The checks passed. The launch sequence begins. The rocket is sent to space (Code is sent to the production server).

4. Structuring a CI/CD Pipeline (The needs Keyword) #

jobs:
  test-the-code:
    runs-on: ubuntu-latest
    steps:
      - run: npm test

  deploy-to-prod:
    runs-on: ubuntu-latest
    needs: test-the-code # STOP! Wait for 'test-the-code' to turn green first!
    steps:
      - run: echo "Deploying..."

If test-the-code fails, the deploy-to-prod job is automatically cancelled.

5. Traditional Deployments (SSH/SCP) #

6. Mini Project: Deploy PHP App Automatically #

Step-by-Step Pipeline Concept:

name: Production Deployment
on:
  push:
    branches:
      - main # Only deploy when code is pushed directly to main

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo "Running tests..."

  deploy:
    runs-on: ubuntu-latest
    needs: test # Ensure tests pass first!
    
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        
      - name: Copy files via SCP to Production Server
        uses: appleboy/scp-action@master
        with:
          host: 192.168.1.50 # Server IP
          username: admin # Server Username
          key: ${{ secrets.SSH_PRIVATE_KEY }} # We will cover Secrets later!
          source: "."
          target: "/var/www/html/myapp"

      - name: Execute remote SSH commands
        uses: appleboy/ssh-action@master
        with:
          host: 192.168.1.50
          username: admin
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd /var/www/html/myapp
            composer install --no-dev
            sudo systemctl reload nginx

7. Real-World Scenarios #

8. Best Practices #

• Deployment Environments: GitHub has a feature called "Environments." In your repository settings, you can create an environment named production. You can add "Protection Rules" to this environment, such as requiring a specific manager to click "Approve" before the deployment job is allowed to run.

9. Security Recommendations #

• Least Privilege SSH: The SSH Key used by GitHub Actions to log into your production server should not belong to the root user. Create a dedicated Linux user (e.g., github_deployer) on your server that only has permission to write to the /var/www/html directory. If your GitHub account is compromised, the attacker only gains limited access to the server, rather than total root control.

10. Troubleshooting Tips #

• Rsync vs SCP: The scp-action copies every single file, every single time. If your project has 10,000 files, this takes a very long time and causes downtime. For larger projects, look into actions that use rsync, which only transfers files that have changed since the last deployment.

11. Exercises #

1. 1. What is the purpose of the needs keyword when defining multiple jobs in a workflow?

1. 2. Why must we use a Marketplace Action (like appleboy/ssh-action) to execute remote commands, instead of just using standard shell commands on the runner?

12. FAQs #

13. Interview Questions #

• Q: Architect a GitHub Actions workflow containing 'Build', 'Test', and 'Deploy' jobs. Explain the YAML configuration required to ensure they execute sequentially, and detail what happens if the 'Test' job fails.

• Q: Describe the security risks of performing direct SSH deployments from GitHub Actions. How would you mitigate the risk of exposing the production server to unauthorized access?

14. Summary #

15. Next Chapter Recommendation #