From d1e8a774c93be32d84459a115ae8b80ab157f31a Mon Sep 17 00:00:00 2001
From: Interchouette <484423+Interchouette@users.noreply.github.com>
Date: Tue, 25 Aug 2026 12:42:23 +0200
Subject: [PATCH] ci(docker): redeploy Render after tip image push

After Hub/GHCR :dev and :latest push, call the Render deploy hook so
the live demo picks up the new digest without a manual redeploy.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/docker-build-push-dev.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.github/workflows/docker-build-push-dev.yml b/.github/workflows/docker-build-push-dev.yml
index b43ce76..f88dc65 100644
--- a/.github/workflows/docker-build-push-dev.yml
+++ b/.github/workflows/docker-build-push-dev.yml
@@ -66,3 +66,22 @@ jobs:
 
       - name: Push :dev and :latest to ghcr.io/interchouette and interchouette-itc
         run: make docker-push-dev-ghcr-itc
+
+      - name: Redeploy Render
+        env:
+          RENDER_DEPLOY_HOOK_URL: ${{ secrets.RENDER_DEPLOY_HOOK_URL }}
+        run: |
+          if [ -z "${RENDER_DEPLOY_HOOK_URL}" ]; then
+            echo "RENDER_DEPLOY_HOOK_URL secret not set; skipping Render redeploy"
+            exit 0
+          fi
+          hook="$(printf '%s' "$RENDER_DEPLOY_HOOK_URL" | tr -d '\r\n')"
+          # GET, no body. Do not print the URL (it is the secret).
+          http_code="$(curl -sS -o /tmp/render-hook.json -w '%{http_code}' --get "$hook")"
+          echo "render_hook_http=${http_code}"
+          cat /tmp/render-hook.json
+          echo
+          case "$http_code" in
+            200|202) ;;
+            *) exit 1 ;;
+          esac