.gitea/workflows/deploy.yml

@@ -103,6 +103,7 @@ jobs:
         id: deploy
         run: |
           set -o pipefail
+          SSH_RC=0
           OUTPUT=$(ssh -o StrictHostKeyChecking=no \
               -o HostKeyAlgorithms=ssh-ed25519,rsa-sha2-256,rsa-sha2-512 \
               -o ConnectTimeout=15 \
@@ -212,14 +213,22 @@ jobs:
           # the pre-pull prune above for why this can't touch anything live.
           docker image prune -af
           ENDSSH
-          )
+          ) || SSH_RC=$?
           echo "$OUTPUT"
+          # server-26#167: check SUPERSEDED before the ssh exit status. The
+          # remote `exit 0` still came back as ssh exit 1 on the VM (runs 1139,
+          # 1144 on 2026-10-04), so under `bash -e` a correct skip was reported
+          # as a failed deploy. A superseded run touched nothing, whatever ssh says.
           SUPERSEDED=$(printf '%s\n' "$OUTPUT" | grep '^SUPERSEDED=' | tail -n1 | cut -d'=' -f2 || true)
           if [ -n "$SUPERSEDED" ]; then
             echo "main has moved on to $SUPERSEDED - this run (${{ gitea.sha }}) is superseded, nothing deployed."
             echo "superseded=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          if [ "$SSH_RC" -ne 0 ]; then
+            echo "Deploy SSH session failed (exit $SSH_RC)."
+            exit "$SSH_RC"
+          fi
           PREV_TAG=$(printf '%s\n' "$OUTPUT" | grep '^PREV_TAG=' | tail -n1 | cut -d'=' -f2)
           if [ -z "$PREV_TAG" ]; then
             echo "Could not determine the previous tag from deploy output - rollback target unknown."