fix: use SHA tags instead of latest for GHCR images

.github/workflows/build.yml

@@ -38,7 +38,6 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            type=raw,value=latest
             type=sha,prefix=
 
       - name: Build and push Docker image
@@ -54,4 +53,4 @@ jobs:
         with:
           token: ${{ secrets.DEPLOY_TOKEN }}
           event-type: deploy
-          client-payload: '{"image_tag": "${{ github.sha }}"}'
+          client-payload: '{"image_tag": "${{ steps.meta.outputs.version }}"}'

.github/workflows/deploy.yml

@@ -25,17 +25,22 @@ jobs:
 
       - name: Pull and restart container
         run: |
-          ssh ${{ env.VPS_USER }}@${{ env.VPS_HOST }} << 'EOF'
+          ssh ${{ env.VPS_USER }}@${{ env.VPS_HOST }} << 'DEPLOY_EOF'
             set -e
+            IMAGE_TAG="${{ github.event.client_payload.image_tag }}"
+            IMAGE="ghcr.io/mytheclipse/proxy-bun:${IMAGE_TAG}"
 
             echo "=== Logging in to GHCR ==="
             echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
-            echo "=== Pulling latest image ==="
+            echo "=== Pulling image: ${IMAGE} ==="
-            docker pull ghcr.io/mytheclipse/proxy-bun:latest
+            docker pull "${IMAGE}"
+
+            echo "=== Updating docker-compose.yml ==="
+            cd /opt/edge-proxy
+            sed -i "s|image:.*|image: ${IMAGE}|" docker-compose.yml
 
             echo "=== Stopping old container ==="
-            cd /opt/edge-proxy
             docker compose down || true
 
             echo "=== Starting new container ==="
@@ -46,7 +51,7 @@ jobs:
             curl -sf http://localhost:3000/health || echo "Health check failed"
 
             echo "=== Deployment complete ==="
-          EOF
+          DEPLOY_EOF
 
       - name: Verify deployment
         run: |