Dev

.github/workflows/deploy-lightsail.yml

@@ -4,6 +4,7 @@ on:
   pull_request:
     branches:
       - main
+      - dev
   push:
     branches:
       - main
@@ -49,7 +50,7 @@ jobs:
     name: Deploy
     runs-on: ubuntu-latest
     needs: verify
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main'
     environment: production
     concurrency:
       group: lightsail-production
@@ -61,18 +62,24 @@ jobs:
         env:
           APP_DIR: ${{ secrets.LIGHTSAIL_APP_DIR }}
           BACKEND_URL: ${{ secrets.PRODUCTION_BACKEND_URL }}
+          COMMIT_SHA: ${{ github.sha }}
         with:
           host: ${{ secrets.LIGHTSAIL_HOST }}
           username: ${{ secrets.LIGHTSAIL_USER }}
           key: ${{ secrets.LIGHTSAIL_SSH_KEY }}
-          envs: APP_DIR,BACKEND_URL
+          envs: APP_DIR,BACKEND_URL,COMMIT_SHA
           script_stop: true
           script: |
             set -eu
             cd "$APP_DIR"
 
-            git fetch origin main
-            git reset --hard origin/main
+            git fetch --prune origin +refs/heads/main:refs/remotes/origin/main
+            MAIN_SHA="$(git rev-parse origin/main)"
+            if [ "$COMMIT_SHA" != "$MAIN_SHA" ]; then
+              echo "Skipping deploy for outdated commit $COMMIT_SHA; current origin/main is $MAIN_SHA."
+              exit 1
+            fi
+            git reset --hard "$COMMIT_SHA"
 
             npm ci
             VITE_BACKEND_URL="$BACKEND_URL" npm run build:web