Girhub action to deploy with rsync without storing ssh creds in file system

build_and_deploy.sh

#!/bin/bash
set -o allexport
source .env
set +o allexport

cd webapp && npm run build && cd .. &&
	ssh ${SSH_USER}@${SSH_HOST} -p $SSH_PORT "mkdir -p /var/www/example.com/webapp" &&
	rsync -avzr --delete --filter=':- .gitignore' -e 'ssh -p '${SSH_PORT} webapp/dist/webapp/ ${SSH_USER}@${SSH_HOST}:/var/www/example.com/webapp/

deploy.yml

name: DEPLOY
on:
  push:
    branches:
      # https://stackoverflow.com/questions/64781462/github-actions-default-branch-variable/72080588#72080588
      - main

env:
  SSH_AUTH_SOCK: /tmp/ssh_agent.sock

jobs:
  deploy:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./webapp
    steps:
      - uses: actions/checkout@v2
      - name: Setup SSH
        run: |
          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
          ssh-add - <<< "${{ secrets.DEPLOY_KEY }}"
          mkdir -m 700 -p ~/.ssh/
          ssh-keyscan -p ${{ vars.SSH_PORT }} ${{ vars.SSH_HOST }} >> ~/.ssh/known_hosts
      - uses: actions/setup-node@v3
        with:
          node-version: 18.x
          cache: "npm"
          cache-dependency-path: webapp/package-lock.json
      - name: Prepare
        run: |
          npm ci
      - name: rsync
        run: |
          cd ..
          echo SSH_USER=${{ vars.SSH_USER }} >> .env
          echo SSH_HOST=${{ vars.SSH_HOST }} >> .env
          echo SSH_PORT=${{ vars.SSH_PORT }} >> .env
          ./build_and_deploy.sh