feat: push-based deploy - target host needs only Docker + Compose

.github/actions/build-bundle/action.yml

@@ -1,25 +1,12 @@
 name: Build and upload bundle
-description: Build a zip bundle from specified paths and upload it as a GitHub Release asset. Defaults to Flightdeck's own machinery bundle.
+description: Build a zip bundle from specified paths and upload it as a GitHub Release asset.
 inputs:
   paths:
     description: Newline-separated paths to include in the bundle.
-    required: false
-    default: |
-      ansible.cfg
-      .env.example
-      backup.sh
-      deploy.sh
-      down.sh
-      generate-env.sh
-      lib.sh
-      logs.sh
-      restart.sh
-      up.sh
-      README.md
+    required: true
   bundle-name:
     description: Bundle archive filename.
-    required: false
-    default: flightdeck.zip
+    required: true
   release-tag:
     description: Release tag to upload the bundle asset to.
     required: true

.github/workflows/deploy-shared.yml

@@ -6,20 +6,12 @@ on:
         description: JSON array of user@host SSH destinations to deploy to.
         type: string
         required: true
-      app-ref:
-        description: Full release ref of the Flightdeck bundle to deploy, in owner/repo@tag format.
-        type: string
-        required: true
-      env-refs:
-        description: JSON array of release refs for encrypted env packages to decrypt and merge, in owner/repo@tag[:asset] format.
-        type: string
-        required: true
       app-refs:
         description: JSON array of release refs for app bundles to merge into the release, in owner/repo@tag[:asset] format.
         type: string
         required: true
       apps:
-        description: JSON array of app names to run on this target, rendered into the deployed env as APPS.
+        description: JSON object mapping each app name to run on this target to its own env_refs list, e.g. {"traefik":{"env_refs":["owner/repo@latest:traefik.sops.env"]}}.
         type: string
         required: true
       path:
@@ -30,10 +22,6 @@ on:
         description: Number of past releases to keep on the target host.
         type: number
         default: 5
-      sops-age-key-file:
-        description: Path to the server-local SOPS age key file, relative to each SSH user's home when it starts with ~.
-        type: string
-        default: "~/.config/sops/age/keys.txt"
       tailscale-oauth-client-id:
         description: Tailscale OAuth client ID used to join the tailnet. Leave unset to skip joining a tailnet (e.g. when the runner already has network access to the hosts).
         type: string
@@ -46,6 +34,9 @@ on:
       ssh-private-key:
         description: SSH private key used to connect to the hosts.
         required: true
+      sops-age-key:
+        description: Private SOPS age key used to decrypt this target's vault-sourced env, on the runner.
+        required: true
       tailscale-oauth-secret:
         description: Tailscale OAuth client secret used to join the tailnet. Required only when tailscale-oauth-client-id is set.
         required: false
@@ -57,9 +48,18 @@ jobs:
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
-      - name: Install ansible-core
+      - name: Install deploy dependencies
+        shell: bash
+        run: pip install --user --break-system-packages -r deploy/requirements.txt
+      - name: Install sops
         shell: bash
-        run: pip install --user --break-system-packages ansible-core
+        env:
+          SOPS_VERSION: "3.13.1"
+        run: |
+          curl --fail --location --silent --show-error \
+            "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+            --output /usr/local/bin/sops
+          chmod +x /usr/local/bin/sops
       - uses: tailscale/github-action@v4
         if: inputs.tailscale-oauth-client-id != ''
         with:
@@ -73,45 +73,22 @@ jobs:
           echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> "$GITHUB_ENV"
           echo "SSH_AGENT_PID=$SSH_AGENT_PID" >> "$GITHUB_ENV"
           ssh-add - <<< "${{ secrets.ssh-private-key }}"
-      - name: Build extra-vars
-        id: vars
+      - name: Run deploy
         shell: bash
         env:
-          APP_REF: ${{ inputs.app-ref }}
-          ENV_REFS: ${{ inputs.env-refs }}
+          HOSTS: ${{ inputs.hosts }}
           APP_REFS: ${{ inputs.app-refs }}
           APPS: ${{ inputs.apps }}
-          HOSTS: ${{ inputs.hosts }}
           DEPLOY_PATH: ${{ inputs.path }}
           KEEP_RELEASES: ${{ inputs.keep-releases }}
-          SOPS_KEY_FILE: ${{ inputs.sops-age-key-file }}
+          SOPS_AGE_KEY: ${{ secrets.sops-age-key }}
         run: |
-          hosts_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and test("^[a-z_][a-z0-9_-]*@[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$")) then . else error("hosts must be a non-empty user@host string array") end' <<< "$HOSTS")"
-          env_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("env-refs must be a non-empty string array") end' <<< "$ENV_REFS")"
-          app_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("app-refs must be a non-empty string array") end' <<< "$APP_REFS")"
-          apps_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("apps must be a non-empty string array") end' <<< "$APPS")"
-          jq -ce '
-            reduce .[] as $destination ({all: {hosts: {}}};
-              ($destination | capture("^(?<user>[^@]+)@(?<host>.+)$")) as $ssh |
-              .all.hosts[$ssh.host] = {ansible_user: $ssh.user}
-            )
-          ' <<< "$hosts_json" > "$RUNNER_TEMP/flightdeck-inventory.json"
-          json="$(jq -n \
-            --arg app_ref "$APP_REF" \
-            --argjson env_refs "$env_refs_json" \
-            --argjson app_refs "$app_refs_json" \
-            --argjson apps "$apps_json" \
+          jq -n \
+            --argjson hosts "$HOSTS" \
+            --argjson app_refs "$APP_REFS" \
+            --argjson apps "$APPS" \
             --arg path "$DEPLOY_PATH" \
             --argjson keep_releases "$KEEP_RELEASES" \
-            --arg sops_key_file "$SOPS_KEY_FILE" \
-            '{flightdeck_app_ref: $app_ref, flightdeck_env_refs: $env_refs, flightdeck_app_refs: $app_refs, flightdeck_apps: $apps, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
-          echo "json=$json" >> "$GITHUB_OUTPUT"
-          echo "inventory=$RUNNER_TEMP/flightdeck-inventory.json" >> "$GITHUB_OUTPUT"
-      - name: Run playbook
-        shell: bash
-        env:
-          ANSIBLE_HOST_KEY_CHECKING: "false"
-        run: |
-          ansible-playbook ansible/deploy.yml \
-            -i "${{ steps.vars.outputs.inventory }}" \
-            -e "${{ steps.vars.outputs.json }}"
+            --arg sops_age_key "$SOPS_AGE_KEY" \
+            '{hosts: $hosts, app_refs: $app_refs, apps: $apps, path: $path, keep_releases: $keep_releases, sops_age_key: $sops_age_key}' \
+            | python3 deploy/deploy.py

.github/workflows/deploy.yml

@@ -27,14 +27,12 @@ jobs:
     uses: $/.github/workflows/deploy-shared.yml
     with:
       hosts: ${{ toJson(matrix.hosts) }}
-      app-ref: ${{ matrix.flightdeck_ref }}
-      env-refs: ${{ toJson(matrix.env_refs) }}
       app-refs: ${{ toJson(matrix.app_refs) }}
       apps: ${{ toJson(matrix.apps) }}
       path: ${{ matrix.path || '~/flightdeck' }}
       keep-releases: ${{ matrix.keep_releases || 5 }}
-      sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}
       tailscale-oauth-client-id: ${{ vars[matrix.credentials.variables.tailscale_oauth_client_id] }}
     secrets:
       ssh-private-key: ${{ secrets[matrix.credentials.secrets.ssh_private_key] }}
       tailscale-oauth-secret: ${{ secrets[matrix.credentials.secrets.tailscale_oauth_secret] }}
+      sops-age-key: ${{ secrets[matrix.credentials.secrets.sops_age_key] }}

.github/workflows/release.yml

@@ -17,18 +17,6 @@ jobs:
         id: release
         with:
           token: ${{ secrets.RELEASE_TOKEN }}
-  upload:
-    needs: release
-    if: needs.release.outputs.release_created == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.release.outputs.tag_name }}
-      - uses: $/.github/actions/build-bundle
-        with:
-          release-tag: ${{ needs.release.outputs.tag_name }}
-          token: ${{ secrets.GITHUB_TOKEN }}
   upload-apps:
     needs: release
     if: needs.release.outputs.release_created == 'true'
@@ -90,21 +78,19 @@ jobs:
         with:
           directory: targets
   deploy:
-    needs: [upload, upload-apps, encrypt, deploy-targets]
+    needs: [upload-apps, encrypt, deploy-targets]
     if: needs.deploy-targets.outputs.count != '0'
     strategy:
       matrix: ${{ fromJson(needs.deploy-targets.outputs.matrix) }}
     uses: $/.github/workflows/deploy-shared.yml
     with:
       hosts: ${{ toJson(matrix.hosts) }}
-      app-ref: ${{ matrix.flightdeck_ref }}
-      env-refs: ${{ toJson(matrix.env_refs) }}
       app-refs: ${{ toJson(matrix.app_refs) }}
       apps: ${{ toJson(matrix.apps) }}
       path: ${{ matrix.path || '~/flightdeck' }}
       keep-releases: ${{ matrix.keep_releases || 5 }}
-      sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}
       tailscale-oauth-client-id: ${{ vars[matrix.credentials.variables.tailscale_oauth_client_id] }}
     secrets:
       ssh-private-key: ${{ secrets[matrix.credentials.secrets.ssh_private_key] }}
       tailscale-oauth-secret: ${{ secrets[matrix.credentials.secrets.tailscale_oauth_secret] }}
+      sops-age-key: ${{ secrets[matrix.credentials.secrets.sops_age_key] }}

.gitignore

@@ -1,7 +1,5 @@
 __pycache__
 /apps-data/*
-/.env
 /apps.env
-/backups/
 /apps/*/.env
 .claude/

.pre-commit-config.yaml

@@ -5,5 +5,4 @@ repos:
       - id: yamllint
       - id: pymarkdown
       - id: ruff
-      - id: shellcheck
       - id: actionlint