From ed181886ddc69e26f1d4b1b091bc0078c035aa9f Mon Sep 17 00:00:00 2001
From: shanshanzhong <shanshanzhong147@gmail.com>
Date: Tue, 2 Jun 2026 21:07:40 -0700
Subject: [PATCH] Use private registry and password SSH for staging

---
 .github/workflows/deploy-staging.yml | 38 ++++++++++++----------------
 1 file changed, 16 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index b35a2dd..df31c80 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -9,13 +9,13 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 env:
-  IMAGE_NAME: ghcr.io/tawcorp/hifast-server
-  DEPLOY_HOST: 154.12.35.103
-  DEPLOY_PATH: /opt/hifast-server
-  HEALTHCHECK_URL: http://127.0.0.1:8080/v1/common/heartbeat
+  REGISTRY_HOST: ${{ vars.REGISTRY_HOST || 'registry.kxsw.us' }}
+  IMAGE_NAME: ${{ vars.REGISTRY_IMAGE || 'registry.kxsw.us/vpn-server' }}
+  STAGING_HOST: ${{ vars.STAGING_HOST || '154.12.35.103' }}
+  STAGING_DEPLOY_PATH: ${{ vars.STAGING_DEPLOY_PATH || '/opt/hifast-server' }}
+  STAGING_HEALTHCHECK_URL: ${{ vars.STAGING_HEALTHCHECK_URL || 'http://127.0.0.1:8080/v1/common/heartbeat' }}
 
 jobs:
   build-and-deploy:
@@ -29,12 +29,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to GitHub Container Registry
+      - name: Log in to private registry
         uses: docker/login-action@v3
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: ${{ env.REGISTRY_HOST }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build and push image
         uses: docker/build-push-action@v6
@@ -53,33 +53,29 @@ jobs:
       - name: Copy compose file
         uses: appleboy/scp-action@v0.1.7
         with:
-          host: ${{ env.DEPLOY_HOST }}
+          host: ${{ env.STAGING_HOST }}
           username: ${{ secrets.STAGING_SSH_USER }}
-          key: ${{ secrets.STAGING_SSH_KEY }}
+          password: ${{ secrets.STAGING_SSH_PASSWORD }}
           port: ${{ secrets.STAGING_SSH_PORT || 22 }}
           source: docker-compose.cloud.yml
           target: /tmp/hifast-server-deploy/
 
       - name: Deploy on staging server
         uses: appleboy/ssh-action@v1.0.3
-        env:
-          GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
-          GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
         with:
-          host: ${{ env.DEPLOY_HOST }}
+          host: ${{ env.STAGING_HOST }}
           username: ${{ secrets.STAGING_SSH_USER }}
-          key: ${{ secrets.STAGING_SSH_KEY }}
+          password: ${{ secrets.STAGING_SSH_PASSWORD }}
           port: ${{ secrets.STAGING_SSH_PORT || 22 }}
           timeout: 300s
           command_timeout: 600s
-          envs: GHCR_USERNAME,GHCR_TOKEN
           script: |
             set -euo pipefail
 
             IMAGE_NAME="${{ env.IMAGE_NAME }}"
             NEW_TAG="${{ github.sha }}"
-            DEPLOY_PATH="${{ env.DEPLOY_PATH }}"
-            HEALTHCHECK_URL="${{ env.HEALTHCHECK_URL }}"
+            DEPLOY_PATH="${{ env.STAGING_DEPLOY_PATH }}"
+            HEALTHCHECK_URL="${{ env.STAGING_HEALTHCHECK_URL }}"
             ROLLBACK_TAG="rollback-${NEW_TAG}"
 
             if command -v sudo >/dev/null 2>&1 && ! docker ps >/dev/null 2>&1; then
@@ -128,9 +124,7 @@ jobs:
               return 1
             }
 
-            if [ -n "${GHCR_USERNAME:-}" ] && [ -n "${GHCR_TOKEN:-}" ]; then
-              echo "$GHCR_TOKEN" | docker_cmd login ghcr.io -u "$GHCR_USERNAME" --password-stdin
-            fi
+            echo "${{ secrets.REGISTRY_PASSWORD }}" | docker_cmd login "${{ env.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
 
             if [ -n "$SUDO" ]; then
               sudo mkdir -p "$DEPLOY_PATH"