fix: make CHECK constraint migration idempotent #20

	name: Deploy

	on:
	push:
	branches: [main]

	env:
	REGISTRY: ghcr.io
	IMAGE_NAME: ${{ github.repository }}

	jobs:
	test:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@v4
	- uses: pnpm/action-setup@v4
	- uses: actions/setup-node@v4
	with:
	node-version: 22
	cache: pnpm
	- run: pnpm install --frozen-lockfile
	- run: pnpm test:run

	build-and-deploy:
	needs: test
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: write
	steps:
	- uses: actions/checkout@v4

	- uses: docker/login-action@v3
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- uses: docker/metadata-action@v5
	id: meta
	with:
	images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
	tags: \|
	type=sha
	type=raw,value=latest

	- uses: docker/build-push-action@v6
	with:
	context: .
	push: true
	tags: ${{ steps.meta.outputs.tags }}

	- name: Deploy to VPS
	env:
	GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	IMAGE_NAME: ${{ github.repository }}
	uses: appleboy/ssh-action@v1
	with:
	host: ${{ secrets.VPS_HOST }}
	username: ${{ secrets.VPS_USERNAME }}
	key: ${{ secrets.VPS_SSH_KEY }}
	envs: GHCR_TOKEN,IMAGE_NAME
	script: \|
	set -e
	cd ~/devsol
	echo "$GHCR_TOKEN" \| docker login ghcr.io -u ${{ github.actor }} --password-stdin
	docker compose pull
	docker compose up -d
	docker image prune -f

	# Health check (max 1 min)
	for i in $(seq 1 30); do
	if curl -sf http://localhost:7003/health >/dev/null 2>&1; then
	echo "Deployment healthy"
	exit 0
	fi
	echo "Waiting for service ($i/30)..."
	sleep 2
	done
	echo "Health check failed"
	exit 1

Provide feedback