- Skip deploy if CI SHA is not the current tip of main (prevents stale
rerun from rolling back production)
- Add SSH host fingerprint to prevent MITM during deployment
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Checkout the specific commit that passed CI instead of origin/main tip
- Only deploy on push events to main, skip PR CI runs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Deploys to Hetzner VPS on every push to main via SSH.
Pulls latest, installs deps, builds, and restarts pm2 services.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>