- If you are in a hurry… that is fine!<\/a>
- What you need<\/a>
- What the GitHub Action will do<\/a>
- SSH Access<\/a>
- 1. Create a pair of SSH keys<\/a>
- 2. Authorize the key to connect to your server<\/a>
- 3. Test the SSH key (Optional)<\/a><\/li><\/ul><\/li>
- GitHub Actions<\/a>
- Workflow name<\/a>
- Secrets for GitHub Action<\/a>
- How to create a secret in GitHub Actions<\/a><\/li><\/ul>
- Triggers and Events<\/a>
- Jobs<\/a>
- Steps<\/a>
- SSH Configuration<\/a>
- Send files with rsync<\/a>
- About exclusions and rsync<\/a><\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li>
- Doing more with GitHub Actions<\/a>
- Why you should not use SFTP anymore<\/a>
- Conclusion<\/a><\/ul><\/ul><\/ul><\/ol>\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\n\n\n
If you are in a hurry… that is fine!<\/h2>\n\n\n\n
There is no problem if you are in a hurry. In summary, this is what we are going to do:<\/p>\n\n\n\n
- \n
- Create an SSH Keys pair to connect to your server<\/a>;<\/li>\n\n\n\n
- Create the
DEPLOY_SSH_HOST<\/code>,DEPLOY_SSH_USER<\/code>, andDEPLOY_SSH_KEY<\/code> secrets in GitHub<\/a>;<\/li>\n\n\n\n- Create the
bin\/rsync-excludes.txt<\/code> file in your repository<\/a>;<\/li>\n\n\n\n- Create the
.github\/workflows\/deploy.yml<\/code> file in your repository<\/a>;<\/li>\n\n\n\n- Make any changes in the
trunk<\/code> branch.<\/li>\n<\/ol>\n\n\n\n\n
If this post helps you, don’t forget to share it. Also subscribe to the newsletter to receive new posts!<\/p>\n<\/blockquote>\n\n\n\n
What you need<\/h2>\n\n\n\n
The list of things you need for this post is quite simple:<\/p>\n\n\n\n
- \n
- SSH Acess to your server<\/strong>: Available in almost all host providers nowadays;<\/li>\n\n\n\n
- A GitHub repository<\/strong>: Free and unlimited, including private ones.<\/li>\n<\/ul>\n\n\n\n
Don’t forget to back up your files before you continue. If something goes wrong you will have a way to revert it.<\/p>\n\n\n\n
What the GitHub Action will do<\/h2>\n\n\n\n
Basically, when a file in a certain branch is updated, a GitHub Action will connect to your server via SSH and send the files<\/strong> using the
rsync<\/code> command.<\/p>\n\n\n\n![\"\"](\"https:\/\/felipeelia.com.br\/wp-content\/uploads\/2023\/01\/image-3.png\")
<\/a>The green \u2713 means an Action was executed successfully.<\/figcaption><\/figure>\n\n\n\n SSH Access<\/h2>\n\n\n\n
Your GitHub Action will need to connect to your server via SSH (Secure SHell) to send the files. To make that possible, we will create a new pair of SSH keys and configure the server to accept it<\/strong>.<\/p>\n\n\n\n
1. Create a pair of SSH keys<\/h3>\n\n\n\n
The cryptography used by the SSH protocol uses two keys: a public and a private<\/strong>. So your GitHub Action can send the files to your server, you will need a new pair of keys. Although possible, I do not recommend using the same key you use on your computer.<\/p>\n\n\n\n
The command to create a new key is the following:<\/p>\n\n\n\n
ssh-keygen -t ed25519 -C \"user@domain\"<\/code><\/pre>\n\n\n\n- \n
ssh-keygen<\/code>: The command itself;<\/li>\n\n\n\n-t ed25519<\/code>: The algorithm used in the file creation;<\/li>\n\n\n\n-C \"user@domain\"<\/code>: It does not need to be a real email. It is only used to differentiate keys, as a comment. Something likedeploy@mysite.com<\/code> is enough.<\/li>\n<\/ul>\n\n\n\nThe command will ask:<\/p>\n\n\n\n
- \n
- A password<\/em>: leave it empty to make the process easier;<\/li>\n\n\n\n
- A filename<\/em>: do not use the default, put something like
deploy<\/code> or the project name. Do not add any extensions.<\/li>\n<\/ul>\n\n\n\n![\"\"](\"https:\/\/felipeelia.com.br\/wp-content\/uploads\/2023\/01\/image-5-1024x494.png\")
<\/a>The ssh-keygen<\/code> command and its return<\/figcaption><\/figure>\n\n\n\n2. Authorize the key to connect to your server<\/h3>\n\n\n\n
Each hosting provider handles this in a different way. In services that provide some sort of dashboard, it can be in My Account > SSH or similar.<\/p>\n\n\n\n
On Cloudways, for example, the SSH keys are handled per application. In the Access Details<\/em> section, it is possible to manage the keys under Application Credentials<\/em>. (Cloudways also offers a Deployment Via Git<\/em> option that we are not covering here.)<\/p>\n\n\n\n
![\"\"](\"https:\/\/felipeelia.com.br\/wp-content\/uploads\/2023\/01\/cloudways-ssh-1024x477.png\")
<\/a>Cloudways Application Management dashboard<\/figcaption><\/figure>\n\n\n\n In the image we have arrows pointing to three elements:<\/p>\n\n\n\n
- \n
- Public IP<\/em>: This will be used as the host in our setting. In many cases, it is the website domain.<\/li>\n\n\n\n
- Username<\/em>: Cloudways has a different username<\/em> per application. Some hosts use the same username for dashboard and SSH accesses.<\/li>\n\n\n\n
- SSH Keys<\/em>: This is the place where it is possible to set new keys for this application. There, you can provide the public key (
file.pub<\/code>) of the pair we’ve generated.<\/li>\n<\/ul>\n\n\n\n3. Test the SSH key (Optional)<\/h3>\n\n\n\n
You can use your computer to test the access using the new key. For that, all you have to do is call:<\/p>\n\n\n\n
ssh -i <private-key-filepath> <user>@<server><\/code><\/pre>\n\n\n\n- \n
<private-key-filepath><\/code>: The path to the private key file (without.pub<\/code>) in your computer;<\/li>\n\n\n\n<user>@<server><\/code>: It can change depending on the provider. For that screenshot from Cloudways, it would beappname_ssh@12.34.567.890<\/code>.<\/li>\n<\/ul>\n\n\n\nIf we would use the key generated in our example, the call would look like this:<\/p>\n\n\n\n
ssh -i \/home\/elia\/.ssh\/exemplopost appname_ssh@12.34.567.890<\/code><\/pre>\n\n\n\nIf you had everything right, you will see the server terminal on your computer.<\/p>\n\n\n\n
GitHub Actions<\/h2>\n\n\n\n
GitHub Actions<\/a> is GitHub’s automation tool.<\/strong> In summary, GitHub will analyze any
.yml<\/code> file in the.github\/workflows<\/code> folder of your repository and try to execute it every time something happens in your repo.<\/p>\n\n\n\nIn our case, we will create a file named
.github\/workflows\/deploy.yml<\/code>. You can name it as you want but you need to keep the.yml<\/code> extension and the file location.<\/p>\n\n\n\n\n
ATTENTION: .yml files do not allow tabs<\/em>, only spaces <\/em>(2 or 4).<\/p>\n<\/blockquote>\n\n\n\n
Our
.github\/workflows\/deploy.yml<\/code> file contents will be as follows:<\/p>\n\n\n\nname: Deploy\n\nenv:\n SSH_USER: ${{ secrets.DEPLOY_SSH_USER }}\n SSH_HOST: ${{ secrets.DEPLOY_SSH_HOST }}\n\non:\n push:\n branches:\n - trunk\n\njobs:\n deploy_cloudways:\n name: Deploy to Cloudways\n runs-on: ubuntu-latest\n\n steps:\n - name: Checkout\n uses: actions\/checkout@v2\n\n - name: Configure SSH\n run: |\n mkdir -p ~\/.ssh\/\n echo \"$SSH_KEY\" > ~\/.ssh\/deploy.key\n chmod 600 ~\/.ssh\/deploy.key\n cat >>~\/.ssh\/config <<END\n Host cloudways\n HostName $SSH_HOST\n User $SSH_USER\n IdentityFile ~\/.ssh\/deploy.key\n StrictHostKeyChecking no\n END\n env:\n SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}\n\n - name: Send files\n run: \"rsync --delete -avO ${{ env.RSYNC_FLAGS }} --exclude-from=${{ env.EXCLUDES }} .\/ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:${{ env.DESTINATION }}\"\n env:\n RSYNC_FLAGS: '' #--dry-run\n EXCLUDES: bin\/rsync-excludes.txt\n SSH_HOST: cloudways\n DESTINATION: \"~\/public_html\/wp-content\/\"\n<\/code><\/pre>\n\n\n\nWorkflow name<\/h3>\n\n\n\n
The first line of our file simply gives a name to our workflow<\/a><\/em>. The name is used just for display purposes and does not interfere with the automation functionality.<\/p>\n\n\n\n
name: Deploy\n<\/code><\/pre>\n\n\n\nSecrets for GitHub Action<\/h3>\n\n\n\n
The second section of our file configures environment variables to be shared across some steps <\/em>further up.<\/p>\n\n\n\n
env:\n SSH_USER: ${{ secrets.DEPLOY_SSH_USER }}\n SSH_HOST: ${{ secrets.DEPLOY_SSH_HOST }}<\/code><\/pre>\n\n\n\nAs the description of our workflow is made in a file visible to anyone with read access in the repository, GitHub provides a way to create secrets, editable only by administrators of the repo or organization.<\/p>\n\n\n\n
How to create a secret in GitHub Actions<\/h4>\n\n\n\n
Let’s remember the SSH access command we previously used to test:<\/p>\n\n\n\n
ssh -i <private-key-filepath> <user>@<server><\/code><\/pre>\n\n\n\nWith that command in mind, access your repository, and go to Settings > Secrets and Variables > Actions. We will create three secrets<\/strong>:<\/p>\n\n\n\n
- \n
DEPLOY_SSH_KEY<\/code>: The content<\/strong> of the private key you created.<\/li>\n\n\n\nDEPLOY_SSH_USER<\/code>: What you used as<user><\/code>;<\/li>\n\n\n\nDEPLOY_SSH_HOST<\/code>: What you used as<server><\/code>;<\/li>\n<\/ul>\n\n\n\nNote that
DEPLOY_SSH_KEY<\/code> is different from the others: we are using the file path <\/em>in the command but the secret has the content<\/em> of the file. This happens because we will create the file during the action<\/em> execution.<\/p>\n\n\n\n![\"\"](\"https:\/\/felipeelia.com.br\/wp-content\/uploads\/2023\/01\/image-4-1024x449.png\")
<\/a>Form to create a secret in GitHub<\/figcaption><\/figure>\n\n\n\n The
DEPLOY_SSH_KEY<\/code> secret is not in thisenv<\/code> section on purpose. It will be used later.<\/p>\n\n\n\nTriggers and Events<\/h3>\n\n\n\n
on:\n push:\n branches:\n - trunk<\/code><\/pre>\n\n\n\nThe content of this section is quite self-explanatory: the steps in this file will only be executed if the
trunk<\/code> branch changes.<\/p>\n\n\n\nInstead of
push<\/code>, it could bepull_request<\/code> orschedule<\/code>, for example. <\/p>\n\n\n\nJobs<\/h3>\n\n\n\n
The
jobs<\/code> section is a set of steps to be executed. Our workflow <\/em>file has only one job<\/em> but it is possible to have more than one. Different jobs<\/em> run in parallel.<\/p>\n\n\n\njobs:\n deploy_cloudways:\n name: Deploy to Cloudways\n runs-on: ubuntu-latest<\/code><\/pre>\n\n\n\n
- Username<\/em>: Cloudways has a different username<\/em> per application. Some hosts use the same username for dashboard and SSH accesses.<\/li>\n\n\n\n
- A filename<\/em>: do not use the default, put something like
- A GitHub repository<\/strong>: Free and unlimited, including private ones.<\/li>\n<\/ul>\n\n\n\n
- Create the
- Doing more with GitHub Actions<\/a>
- Triggers and Events<\/a>
- Secrets for GitHub Action<\/a>
- 2. Authorize the key to connect to your server<\/a>
- What you need<\/a>