Deploy Docker ke VPS dengan GitHub Actions dan GHCR

  build-and-push:
    name: Build & push image
    needs: verify
    runs-on: ubuntu-latest
    # Same group as verify: one supersede cancels the whole build chain.
    concurrency:
      group: build-${{ github.ref }}
      cancel-in-progress: true
    permissions:
      contents: read
      packages: write
    outputs:
      image: ${{ steps.meta.outputs.image }}

needs membuat job ini menunggu verify, dan ia memakai concurrency group yang sama dengan verify, jadi satu push baru membatalkan seluruh rantai build. Hanya job ini yang punya packages: write. Output image-nya adalah cara deploy tahu build mana yang harus dijalankan.

  deploy:
    name: Deploy to VPS
    needs: build-and-push
    runs-on: ubuntu-latest
    # The one group that must NEVER cancel in progress. This step SSHes to the
    # VPS and runs `docker compose pull && up -d`; interrupting it can leave the
    # box between images. Concurrent deploys queue and run one at a time, which
    # is the original intent — it is only the build chain above that should be
    # throwing away superseded work.
    concurrency:
      group: deploy-vps
      cancel-in-progress: false
    permissions:
      contents: read
      packages: read

Separuh lain dari pemisahan itu. Group deploy-vps tidak pernah membatalkan deploy yang sedang berjalan, jadi sesi SSH tidak pernah terputus di antara pull dan up. Job ini hanya bisa membaca package, tidak menulis, dan memang hanya itu yang dibutuhkan server yang cukup menarik image.

      - name: Compute lowercase image ref
        id: meta
        run: |
          ref="$(echo "ghcr.io/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')"
          echo "ref=${ref}" >> "$GITHUB_OUTPUT"
          echo "image=${ref}:${{ github.sha }}" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ steps.meta.outputs.ref }}:latest
            ${{ steps.meta.outputs.ref }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

Nama image diambil dari github.repository lalu diubah ke huruf kecil dengan tr, jadi path registry tidak pernah diketik manual. Login memakai GITHUB_TOKEN milik job, bukan password yang disimpan. Dua tag di-push: latest untuk manusia, dan SHA commit, yang dibawa output image ke job deploy.

      - name: Restore Next.js build cache
        uses: actions/cache@v4
        with:
          path: .next/cache
          # SHA in the key so every run writes a fresh entry; restore-keys then
          # falls back to the most recent cache for the same lockfile, and
          # finally to any cache at all, rather than starting cold.
          key: next-cache-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
          restore-keys: |
            next-cache-${{ hashFiles('package-lock.json') }}-
            next-cache-

Kalau key cocok persis, cache tidak akan pernah disimpan lagi, jadi key-nya membawa SHA dan selalu baru di setiap run. restore-keys berupa prefix: cache terbaru untuk lockfile ini yang dipakai, dan cache apa pun tetap lebih baik daripada mulai dari nol.

      # Best-effort, because it is an optimisation and the image is already
      # pushed by this point. It is meant to reuse every layer from the build
      # above, but on 2026-10-03 BuildKit had dropped them: this step re-ran
      # npm ci and the whole next build, then died with "EOF" exporting the
      # 572 MB cache. That failed the job, and `needs: build-and-push` then
      # skipped the deploy of an image that had built and pushed cleanly.
      - name: Extract Next.js build cache
        id: extract-next-cache
        continue-on-error: true
        uses: docker/build-push-action@v6
        with:
          context: .
          target: cache-export
          outputs: type=local,dest=/tmp/next-cache
          cache-from: type=gha

Separuh perjalanan pulangnya: build hanya stage cache-export lalu tulis hasilnya ke folder lokal. Komentarnya adalah insiden yang membuat step ini best-effort. Step berikutnya memeriksa steps.extract-next-cache.outcome, yaitu hasil sebelum continue-on-error diterapkan, dan tidak menyimpan cache kalau step ini gagal.

            # Write runtime env from GitHub Secrets/Variables. Quoted heredoc so
            # shell does not expand anything in the (already-rendered) values.
            cat > .env <<'ENVEOF'
            GROQ_API_KEY=${{ secrets.GROQ_API_KEY }}
            RESEND_API_KEY=${{ secrets.RESEND_API_KEY }}
            CONTACT_FROM_EMAIL=${{ vars.CONTACT_FROM_EMAIL }}
            CONTACT_TO_EMAIL=${{ vars.CONTACT_TO_EMAIL }}
            IMAGE=${{ needs.build-and-push.outputs.image }}
            APP_PORT=${{ vars.APP_PORT || 3002 }}
            ENVEOF
            chmod 600 .env

            echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin

Satu-satunya tempat secret aplikasi muncul. GitHub me-render ekspresinya sebelum script berjalan, dan 'ENVEOF' yang diberi tanda kutip mencegah shell mengekspansi tanda $ di dalam nilai. IMAGE adalah referensi bertag SHA dari build-and-push. Token dikirim ke docker login lewat pipe, tidak pernah sebagai argumen.