@akash-chowdhury-24/deployhub 2.0.41 → 2.0.44

package/src/deployment/providers/ssh.js

@@ -3,6 +3,11 @@ import { createLogger } from '../../logger/index.js';
 import { getEnvSettings } from '../../core/config.js';
 import { createSshExecSession } from '../ssh-connection.js';
 import { runDeployHooks } from '../hooks.js';
+import {
+  readManagedEnvFileContent,
+  resolveSshManagedEnvRemotePaths,
+  uploadManagedEnvFile,
+} from '../env-file.js';
 import {
   getNginxSitesAvailablePath,
   getNginxSitesEnabledPath,
@@ -75,7 +80,8 @@ export function createSshProvider(config, envName, env = process.env) {
   const { connect, exec, defaultExecTimeoutMs } = session;
   const startStopTimeoutMs = Math.min(
     defaultExecTimeoutMs,
-    Number(env.DEPLOYHUB_SSH_START_TIMEOUT_MS) || 60_000
+    Number(env.DEPLOYHUB_SSH_START_TIMEOUT_MS || process.env.DEPLOYHUB_SSH_START_TIMEOUT_MS) ||
+      60_000
   );
 
   /**
@@ -253,9 +259,23 @@ export function createSshProvider(config, envName, env = process.env) {
     await assertPidAliveAfterStart(ssh, targetPath);
   }
 
+  /**
+   * After the framework's package-manager install (and any built-in migrate
+   * / artisan steps), before stop/start. Same stage name on rollback so
+   * codegen re-runs against the restored files. No-op when the env has no
+   * `postInstall` hooks.
+   *
+   * @param {import('node-ssh').NodeSSH} ssh
+   * @returns {Promise<import('node-ssh').NodeSSH>}
+   */
+  async function runPostInstallHooks(ssh) {
+    return runDeployHooks({ session, ssh, settings, stage: 'postInstall' });
+  }
+
   /**
    * @param {import('node-ssh').NodeSSH} ssh
    * @param {string} targetPath
+   * @returns {Promise<import('node-ssh').NodeSSH>} possibly replaced after postInstall reconnect
    */
   async function runBackendStartSequence(ssh, targetPath) {
     const framework = resolveFramework();
@@ -265,6 +285,7 @@ export function createSshProvider(config, envName, env = process.env) {
 
     if (NODE_FRAMEWORKS.has(framework)) {
       await exec(ssh, `cd ${dir} && npm install --production`);
+      ssh = await runPostInstallHooks(ssh);
       const start = startCommand || 'npm start';
       if (start === 'npm start') {
         await exec(
@@ -285,7 +306,7 @@ export function createSshProvider(config, envName, env = process.env) {
         );
       }
       await exec(ssh, 'pm2 save');
-      return;
+      return ssh;
     }
 
     if (PYTHON_FRAMEWORKS.has(framework)) {
@@ -293,6 +314,7 @@ export function createSshProvider(config, envName, env = process.env) {
       if (framework === 'django') {
         await exec(ssh, `cd ${dir} && python manage.py migrate`);
       }
+      ssh = await runPostInstallHooks(ssh);
       await stopScopedBackendProcess(ssh, targetPath);
       if (framework === 'fastapi') {
         await startScopedNohup(
@@ -318,7 +340,7 @@ export function createSshProvider(config, envName, env = process.env) {
         );
         await assertPidAliveAfterStart(ssh, targetPath, logFile);
       }
-      return;
+      return ssh;
     }
 
     if (PHP_FRAMEWORKS.has(framework)) {
@@ -338,14 +360,17 @@ export function createSshProvider(config, envName, env = process.env) {
         await exec(ssh, `cd ${dir} && php artisan config:cache`);
       }
 
+      ssh = await runPostInstallHooks(ssh);
+
       const fpmUnit = await resolveRemotePhpFpmUnit(ssh, phpVersion);
       log.info(`Restarting PHP-FPM service: ${fpmUnit}`);
       await exec(ssh, `sudo systemctl restart ${sh(fpmUnit)}`);
       await reloadNginx(ssh);
-      return;
+      return ssh;
     }
 
     if (framework === 'spring' || framework === 'java') {
+      ssh = await runPostInstallHooks(ssh);
       await stopScopedBackendProcess(ssh, targetPath);
       // -Ddeployhub.app= embeds the env-scoped identity in the JVM command line
       // so cmdline marker scans and the PID file both target only this env.
@@ -354,18 +379,20 @@ export function createSshProvider(config, envName, env = process.env) {
         targetPath,
         `java -Ddeployhub.app=${appName} -jar target/*.jar`
       );
-      return;
+      return ssh;
     }
 
     if (framework === 'go') {
+      ssh = await runPostInstallHooks(ssh);
       await stopScopedBackendProcess(ssh, targetPath);
       // Binary is always ./bin/app — must NOT pkill by appName alone (that never
       // matched the process) and must NOT pkill a bare "app" (cross-env collision).
       await startScopedNohup(ssh, targetPath, './bin/app');
-      return;
+      return ssh;
     }
 
     if (framework === 'dotnet') {
+      ssh = await runPostInstallHooks(ssh);
       await stopScopedBackendProcess(ssh, targetPath);
       // Discover the published DLL at runtime — csproj name is not always App.dll
       // (same class of bug as the Docker CMD ["dotnet","App.dll"] hardcode).
@@ -374,22 +401,25 @@ export function createSshProvider(config, envName, env = process.env) {
         targetPath,
         `sh -c 'dll=$(ls -1 *.dll 2>/dev/null | head -n1); test -n "$dll" || { echo "No .dll found in $(pwd) for .NET start" >&2; exit 1; }; exec dotnet "$dll"'`
       );
-      return;
+      return ssh;
     }
 
     if (framework === 'rails' || framework === 'ruby') {
       await exec(ssh, `cd ${dir} && bundle install --deployment`);
+      ssh = await runPostInstallHooks(ssh);
       await stopScopedBackendProcess(ssh, targetPath);
       await startScopedNohup(ssh, targetPath, `bundle exec puma -b tcp://0.0.0.0:${port}`);
-      return;
+      return ssh;
     }
 
     await exec(ssh, `cd ${dir} && npm install --production`);
+    ssh = await runPostInstallHooks(ssh);
     await exec(
       ssh,
       `cd ${dir} && pm2 restart ${sh(appName)} || pm2 start npm --name ${sh(appName)} -- start`
     );
     await exec(ssh, 'pm2 save');
+    return ssh;
   }
 
   /**
@@ -539,6 +569,33 @@ export function createSshProvider(config, envName, env = process.env) {
     await exec(ssh, `unzip -o ${sh(remoteZip)} -d ${sh(targetPath)}`);
   }
 
+  /**
+   * DeployHub-managed .env: SFTP the current GitHub Secret onto the target.
+   * Overwrites every deploy, including rollback — .env is the current secret,
+   * not versioned per buildId. Runs after unzip/rsync and before
+   * runBackendStartSequence (install → postInstall → start), so a postInstall
+   * hook can `cd {deployPath} && set -a && . ./.env && set +a && prisma generate`.
+   * No-op when envFileSecretName is unset (hand-placed .env then survives
+   * unzip -o, same as before).
+   *
+   * @param {import('node-ssh').NodeSSH} ssh
+   */
+  async function uploadManagedEnvIfConfigured(ssh) {
+    const content = readManagedEnvFileContent(env, settings);
+    if (content == null) return;
+    const paths = resolveSshManagedEnvRemotePaths(config, settings);
+    for (const remotePath of paths) {
+      await uploadManagedEnvFile({
+        ssh,
+        session,
+        content,
+        remotePath,
+        user,
+        log,
+      });
+    }
+  }
+
   /**
    * @param {string} artifactDir
    * @param {{ isRollback?: boolean }} [options]
@@ -546,6 +603,9 @@ export function createSshProvider(config, envName, env = process.env) {
   async function deploy(artifactDir, options = {}) {
     const isRollback = options.isRollback === true;
     const preStage = isRollback ? 'rollback' : 'preDeploy';
+    // Fail fast (before SSH): GitHub Actions injects "" when the secret was
+    // never added or the name is misspelled. Must not unzip then write empty .env.
+    readManagedEnvFileContent(env, settings);
     let ssh = await connect();
     const projectType = config.projectType || 'frontend';
 
@@ -577,11 +637,13 @@ export function createSshProvider(config, envName, env = process.env) {
             `rsync -a ${sh(remoteStaging)}/backend/ ${sh(backendDeployPath)}/ || cp -r ${sh(remoteStaging)}/backend/* ${sh(backendDeployPath)}/`
           );
 
+          await uploadManagedEnvIfConfigured(ssh);
+
           if (await remoteFileExists(ssh, `${frontendDeployPath}/nginx.conf`)) {
             await setupNginx(ssh, frontendDeployPath);
           }
 
-          await runBackendStartSequence(ssh, backendDeployPath);
+          ssh = await runBackendStartSequence(ssh, backendDeployPath);
         } finally {
           await exec(ssh, `rm -rf ${sh(remoteStaging)}`).catch(() => {});
         }
@@ -589,15 +651,17 @@ export function createSshProvider(config, envName, env = process.env) {
         log.info(`Backend deploy path: ${deployPath}`);
         ssh = await runDeployHooks({ session, ssh, settings, stage: preStage });
         await extractToPath(ssh, remoteZip, deployPath);
-        await runBackendStartSequence(ssh, deployPath);
+        await uploadManagedEnvIfConfigured(ssh);
+        ssh = await runBackendStartSequence(ssh, deployPath);
       } else {
         log.info(`Frontend deploy path: ${deployPath}`);
         ssh = await runDeployHooks({ session, ssh, settings, stage: preStage });
         await extractToPath(ssh, remoteZip, deployPath);
+        await uploadManagedEnvIfConfigured(ssh);
 
         const framework = config.framework || 'react';
         if (framework === 'nextjs') {
-          await runBackendStartSequence(ssh, deployPath);
+          ssh = await runBackendStartSequence(ssh, deployPath);
         } else if (await remoteFileExists(ssh, `${deployPath}/nginx.conf`)) {
           await setupNginx(ssh, deployPath);
         }

package/src/deployment/ssh-connection.js

@@ -28,8 +28,12 @@ export function createSshExecSession(opts) {
   const log = opts.log || { info() {}, error() {} };
 
   // Defense-in-depth: never let a stuck SSH channel hang CI indefinitely.
-  // Override with DEPLOYHUB_SSH_EXEC_TIMEOUT_MS (ms).
-  const defaultExecTimeoutMs = Number(env.DEPLOYHUB_SSH_EXEC_TIMEOUT_MS) || 120_000;
+  // Override with DEPLOYHUB_SSH_EXEC_TIMEOUT_MS (ms). Production default is 120s.
+  // Fall back to process.env so sparse credential overlays in tests/CI do not
+  // drop a process-level timeout override.
+  const defaultExecTimeoutMs =
+    Number(env.DEPLOYHUB_SSH_EXEC_TIMEOUT_MS || process.env.DEPLOYHUB_SSH_EXEC_TIMEOUT_MS) ||
+    120_000;
 
   async function connect() {
     if (!host || !user) {

package/src/utils/docker-image-deploy.js

@@ -109,15 +109,36 @@ export function createDockerImageDeployContext(config, env = process.env, log) {
     if (!hasRegistryCredentials()) return;
     const registry = registryUrl || 'https://index.docker.io/v1/';
     log.info('Logging in to container registry...');
-    await execa(
-      'docker',
-      ['login', registry, '-u', registryUser, '--password-stdin'],
-      {
-        input: registryToken,
-        stdio: ['pipe', 'inherit', 'inherit'],
-        env: getDockerEnv(),
+    const attempts = 3;
+    const loopback = /^(127\.0\.0\.1|localhost|\[::1\])/i.test(String(registry));
+    let lastErr;
+    for (let i = 1; i <= attempts; i++) {
+      try {
+        await execa(
+          'docker',
+          ['login', registry, '-u', registryUser, '--password-stdin'],
+          {
+            input: registryToken,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env: getDockerEnv(),
+            timeout: 60_000,
+          }
+        );
+        return;
+      } catch (err) {
+        lastErr = err;
+        const execErr = /** @type {{ message?: string, stderr?: string, stdout?: string }} */ (err);
+        const combined = `${execErr?.message || ''} ${execErr?.stderr || ''} ${execErr?.stdout || ''}`;
+        const transient =
+          /timeout|deadline exceeded|connection refused|tls handshake|i\/o timeout|eof|reset by peer|502|503/i.test(
+            combined
+          );
+        if (i === attempts || (!transient && !loopback)) throw err;
+        log.warn(`docker login attempt ${i}/${attempts} failed, retrying...`);
+        await new Promise((r) => setTimeout(r, 2000 * i));
       }
-    );
+    }
+    throw lastErr;
   }
 
   /**

package/src/utils/docker-remote.js

@@ -178,7 +178,7 @@ export async function probeRemoteDockerPs(target) {
  * @param {string} imageRef
  * @param {string} containerName
  * @param {Record<string, string>} [runEnv]
- * @param {{ publishPort?: number|null }} [options]
+ * @param {{ publishPort?: number|null, envFile?: string }} [options]
  */
 export function buildRemoteDockerCommands(imageRef, containerName, runEnv = {}, options = {}) {
   const image = shellQuote(imageRef);
@@ -192,12 +192,17 @@ export function buildRemoteDockerCommands(imageRef, containerName, runEnv = {},
   const publishPort = options.publishPort;
   const pFlag =
     publishPort != null ? `-p ${shellQuote(`${publishPort}:${publishPort}`)} ` : '';
+  const envFile = options.envFile;
+  const envFileFlag =
+    envFile != null && String(envFile).trim()
+      ? `--env-file ${shellQuote(String(envFile).trim())} `
+      : '';
 
   return {
     stop: `docker stop ${name} 2>/dev/null || true`,
     rm: `docker rm -f ${name} 2>/dev/null || true`,
     pull: `docker pull ${image}`,
-    run: `docker run -d --rm --name ${name} ${pFlag}${envArg}${image}`,
+    run: `docker run -d --rm --name ${name} ${pFlag}${envFileFlag}${envArg}${image}`,
     ps: `docker ps --filter ${shellQuote(`name=^/${containerName}$`)} --format ${shellQuote('{{.Status}}')}`,
     info: 'docker info',
     /**