From a993b8d643de3f5ff0646426f38f87cf6bd61808 Mon Sep 17 00:00:00 2001
From: Diego Cirilo <dvcirilo@gmail.com>
Date: Sat, 19 Sep 2026 20:42:40 -0300
Subject: [PATCH] usando GHCR

---
 .github/workflows/main.yml | 74 +++++++++++++++++++++++++++++++-------
 compose.yaml               |  1 +
 2 files changed, 62 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 5710b50..cc37016 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,4 +1,5 @@
 name: Deploy Django
+
 on:
   push:
     branches:
@@ -32,18 +33,63 @@ jobs:
             echo "has_prod_key=false" >> $GITHUB_OUTPUT
           fi
 
+  build:
+    if: |
+      (github.event_name == 'push' && github.ref == 'refs/heads/dev') ||
+      (github.event_name == 'pull_request' && github.event.pull_request.merged == true)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set lowercase image name
+        run: echo "IMAGE_NAME=ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
+
+      - name: Determine image tag
+        id: tag
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "tag=latest" >> $GITHUB_OUTPUT
+          else
+            echo "tag=dev" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}
+            ${{ env.IMAGE_NAME }}:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
   deploy_dev:
-    needs: check-secrets
+    needs: [check-secrets, build]
     if: |
-      github.event_name == 'push' && 
+      github.event_name == 'push' &&
       github.ref == 'refs/heads/dev' &&
       needs.check-secrets.outputs.has_dev_key == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Setup SSH
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@v0.10.0
         with:
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY_DEV }}
       - name: Add server to known_hosts
@@ -57,16 +103,17 @@ jobs:
             --exclude=".github" \
             --exclude=".env" \
             ./ ${{ secrets.SERVER_USER_DEV }}@${{ secrets.SERVER_DEV }}:${{ secrets.LOCATION_DEV }}
-      - name: Restart Docker Compose
+      - name: Pull image and restart Docker Compose
         run: |
           ssh ${{ secrets.SERVER_USER_DEV }}@${{ secrets.SERVER_DEV }} << 'EOF'
           cd ${{ secrets.LOCATION_DEV }}
-          docker compose -f compose.yaml up --build -d
-          docker compose -f compose.yaml run --rm django python manage.py migrate
+          export IMAGE_TAG=dev
+          docker compose -f compose.yaml pull
+          docker compose -f compose.yaml up -d
           EOF
 
   deploy_prod:
-    needs: check-secrets
+    needs: [check-secrets, build]
     if: |
       github.event_name == 'pull_request' &&
       github.event.pull_request.merged == true &&
@@ -74,9 +121,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Setup SSH
-        uses: webfactory/ssh-agent@v0.9.0
+        uses: webfactory/ssh-agent@v0.10.0
         with:
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
       - name: Add server to known_hosts
@@ -90,10 +137,11 @@ jobs:
             --exclude=".github" \
             --exclude=".env" \
             ./ ${{ secrets.SERVER_USER }}@${{ secrets.SERVER }}:${{ secrets.LOCATION }}
-      - name: Restart Docker Compose
+      - name: Pull image and restart Docker Compose
         run: |
           ssh ${{ secrets.SERVER_USER }}@${{ secrets.SERVER }} << 'EOF'
           cd ${{ secrets.LOCATION }}
-          docker compose -f compose.yaml up --build -d
+          export IMAGE_TAG=latest
+          docker compose -f compose.yaml pull
+          docker compose -f compose.yaml up -d
           EOF
-
diff --git a/compose.yaml b/compose.yaml
index ee94831..bc1f06c 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -10,6 +10,7 @@ services:
     restart: unless-stopped
 
   web:
+    image: ghcr.io/ifrn-spp/presente:${IMAGE_TAG:-latest}
     build:
       context: .
       dockerfile: Dockerfile