Automated Zero-Flake CI/CD with GitHub Actions & SSH Deployments

Edge Hardening: Protect your deployed application upstream with an enterprise-ready reverse proxy architecture using Nginx for rate limiting and security headers.

The Case for Lean Continuous Deployment

In early-stage and high-velocity engineering teams, deployment pipelines often swing between two undesirable extremes: either developers execute error-prone manual deployments via SSH, or organizations spend thousands of dollars on complex, over-engineered continuous delivery SaaS platforms. For most production web systems running on dedicated Linux infrastructure, a lightweight, highly reliable pipeline can be achieved using native GitHub Actions and secure SSH automation.

A zero-flake CI/CD pipeline enforces three essential quality gates before code ever reaches production servers: automated test verification, build-time asset compilation, and atomic remote execution.

1. Phase 1: Ephemeral Test Isolation in GitHub Actions

A deployment pipeline must never deploy unverified code. The first workflow stage spins up an ephemeral Ubuntu runner, installs application dependencies, and executes the entire automated test suite. If any unit test, integration test, or linting check fails, the workflow immediately halts and alerts the team:

# .github/workflows/deploy.yml: Test verification stage
name: Continuous Integration & Deployment
on:
  push:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Install Dependencies
        run: pip install -r requirements.txt
      - name: Execute Automated Test Suite
        run: python manage.py test --no-input

2. Phase 2: Secure SSH Authentication with Deploy Keys

Once the test suite passes, the deployment stage authenticates with the target Linux server. Rather than using passwords or shared credentials, configure a dedicated, restricted ED25519 deploy key stored securely inside GitHub Repository Secrets:

  deploy:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Execute Remote Deployment via SSH
        uses: appleboy/[email protected]
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SERVER_SSH_KEY }}
          script: |
            cd /home/ubuntu/devmanue
            git pull origin main
            ./venv/bin/pip install -r requirements.txt
            ./venv/bin/python manage.py migrate --no-input
            ./venv/bin/python build_assets.py
            ./venv/bin/python manage.py collectstatic --no-input
            sudo systemctl reload devmanue

"Executing systemctl reload rather than restart ensures that Gunicorn rotates worker processes gracefully using SIGHUP, allowing in-flight user requests to complete with zero 502 errors."

3. Rollback Defense & Health Verification

A complete deployment pipeline verifies system health immediately following service reload. By appending a post-deploy curl check against your application's health or status endpoint, the workflow confirms that the server is responding with HTTP 200:

# Automated post-deployment health check
curl -f https://devmanue.com/robots.txt || exit 1

If the health check fails or returns an unexpected status code, the script issues an immediate alert and can trigger an automated rollback to the previous git commit hash.

Key Takeaway

Continuous deployment does not require bloated infrastructure or expensive third-party platforms. By combining automated testing in GitHub Actions with secure SSH execution, asset minification, and graceful service reloads, engineering teams achieve frictionless, zero-downtime releases on every git push.