gh-action

Use a workflow that builds the image, pushes it to GHCR, then runs docker compose pull and up -d --force-recreate over SSH via appleboy/ssh-action. For servers with slow registry access, use docker save, SCP the tarball, and docker load on the server instead.

Create an npm-publish.yml workflow that reads the version from package.json, checks whether the git tag and npm version already exist, creates the tag if missing, and runs npm publish --provenance --access public with an NPM_TOKEN Automation-type secret.

docker compose up -d reuses the locally cached image digest when the tag already exists, even if GHCR's :latest points to a new SHA. Run docker compose pull explicitly before up -d, and add --force-recreate to rebuild containers from the new image.

The build falls back to a debug signature because the release keystore is missing or the keystore preparation step runs after the build step. Configure the four keystore secrets, place the Prepare keystore step before any build command, and verify the SHA-256 fingerprint after building.

Use gh run list and gh run view --log-failed to inspect failures, gh run cancel to stop stuck runs, and gh api to fetch raw job logs when the CLI reports a job still in progress. Grep logs for error, denied, 401, and exit patterns to isolate the cause.

Avoid it for multi-service stacks, images larger than roughly 500 MB, or servers with limited disk, since every deploy loads a complete image without layer reuse. Use the GHCR-based template with docker compose pull when the server has fast registry access.