fix: use SHA tags instead of latest for GHCR images

.github/workflows/deploy.yml

@@ -25,17 +25,22 @@ jobs:
 
       - name: Pull and restart container
         run: |
-          ssh ${{ env.VPS_USER }}@${{ env.VPS_HOST }} << 'EOF'
+          ssh ${{ env.VPS_USER }}@${{ env.VPS_HOST }} << 'DEPLOY_EOF'
             set -e
+            IMAGE_TAG="${{ github.event.client_payload.image_tag }}"
+            IMAGE="ghcr.io/mytheclipse/proxy-bun:${IMAGE_TAG}"
 
             echo "=== Logging in to GHCR ==="
             echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
-            echo "=== Pulling latest image ==="
-            docker pull ghcr.io/mytheclipse/proxy-bun:latest
+            echo "=== Pulling image: ${IMAGE} ==="
+            docker pull "${IMAGE}"
+
+            echo "=== Updating docker-compose.yml ==="
+            cd /opt/edge-proxy
+            sed -i "s|image:.*|image: ${IMAGE}|" docker-compose.yml
 
             echo "=== Stopping old container ==="
-            cd /opt/edge-proxy
             docker compose down || true
 
             echo "=== Starting new container ==="
@@ -46,7 +51,7 @@ jobs:
             curl -sf http://localhost:3000/health || echo "Health check failed"
 
             echo "=== Deployment complete ==="
-          EOF
+          DEPLOY_EOF
 
       - name: Verify deployment
         run: |