From d447523bb149146794d58d17fe8b366bfee4d794 Mon Sep 17 00:00:00 2001
From: MythEclipse <asepharyanalm001@gmail.com>
Date: Fri, 19 Jun 2026 19:12:23 +0700
Subject: [PATCH] fix: use SHA tags instead of latest for GHCR images

---
 .github/workflows/build.yml  |  3 +--
 .github/workflows/deploy.yml | 15 ++++++++++-----
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e00aa65..b6634a2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -38,7 +38,6 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            type=raw,value=latest
             type=sha,prefix=
 
       - name: Build and push Docker image
@@ -54,4 +53,4 @@ jobs:
         with:
           token: ${{ secrets.DEPLOY_TOKEN }}
           event-type: deploy
-          client-payload: '{"image_tag": "${{ github.sha }}"}'
+          client-payload: '{"image_tag": "${{ steps.meta.outputs.version }}"}'
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 191ac9c..914ba7c 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -25,17 +25,22 @@ jobs:
 
       - name: Pull and restart container
         run: |
-          ssh ${{ env.VPS_USER }}@${{ env.VPS_HOST }} << 'EOF'
+          ssh ${{ env.VPS_USER }}@${{ env.VPS_HOST }} << 'DEPLOY_EOF'
             set -e
+            IMAGE_TAG="${{ github.event.client_payload.image_tag }}"
+            IMAGE="ghcr.io/mytheclipse/proxy-bun:${IMAGE_TAG}"
 
             echo "=== Logging in to GHCR ==="
             echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
-            echo "=== Pulling latest image ==="
-            docker pull ghcr.io/mytheclipse/proxy-bun:latest
+            echo "=== Pulling image: ${IMAGE} ==="
+            docker pull "${IMAGE}"
+
+            echo "=== Updating docker-compose.yml ==="
+            cd /opt/edge-proxy
+            sed -i "s|image:.*|image: ${IMAGE}|" docker-compose.yml
 
             echo "=== Stopping old container ==="
-            cd /opt/edge-proxy
             docker compose down || true
 
             echo "=== Starting new container ==="
@@ -46,7 +51,7 @@ jobs:
             curl -sf http://localhost:3000/health || echo "Health check failed"
 
             echo "=== Deployment complete ==="
-          EOF
+          DEPLOY_EOF
 
       - name: Verify deployment
         run: |