From a7c978dd05cf0adf5af03af5e6d5307971731e12 Mon Sep 17 00:00:00 2001
From: Fiqh Pratama <fiqhpratama@yahoo.co.id>
Date: Sat, 11 Oct 2025 22:23:04 +0700
Subject: [PATCH] Update deploy.yml

---
 .github/workflows/deploy.yml | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 3e7be1d..bf03b5b 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,4 +1,4 @@
-name: Deploy to VPS
+name: Deploy to VPS (PAT over HTTPS)
 
 on:
   push:
@@ -8,21 +8,26 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+
     steps:
     - name: Checkout (optional)
       uses: actions/checkout@v4
 
     - name: Deploy to VPS via SSH
       uses: appleboy/ssh-action@v1.0.0
+      env:
+        GIT_TOKEN: ${{ secrets.GIT_TOKEN }}   # <-- simpan PAT di sini (org-wide read-only)
       with:
         host: idc.upsense.co.id
         username: root
         port: 22
-        key: ${{ secrets.SSH_KEY }}
+        key: ${{ secrets.SSH_KEY }}           # private key untuk SSH ke server
         script_stop: true
-        envs: PROJECT_DIR,REPO_SSH
+        envs: GIT_TOKEN                       # kirim env GIT_TOKEN ke sesi SSH
         script: |
+          set -e
           PROJECT_DIR="/var/www/html/xpendify.upsense.co.id"
-          REPO_SSH="git@github.com:upsense-id/TIA-Xpendify.git"
-          mkdir -p "$PROJECT_DIR"
-          /root/deploy.sh "$PROJECT_DIR" "$REPO_SSH"
+          REPO_HTTPS="https://github.com/upsense-id/TIA-Xpendify.git"
+          # GIT_BRANCH dapat dioverride jika perlu:
+          # export GIT_BRANCH="main"
+          /root/deploy.sh "$PROJECT_DIR" "$REPO_HTTPS"