deploy.yml

name: Deploy
on:
  push:
    branches: [main, release]
    paths-ignore: ['**.md']
  pull_request:
    branches: [main]
    paths-ignore: ['**.md']
  issue_comment:
    types: [created]

defaults:
  run:
    shell: bash

permissions:
  pull-requests: write
  issues: read
  contents: read

jobs:
  check-permissions:
    name: Check Permissions
    runs-on: ubuntu-latest
    if: |
      github.event_name == 'push' ||
      github.event_name == 'pull_request' ||
      (github.event_name == 'issue_comment' && github.event.issue.pull_request)
    outputs:
      should-deploy: ${{ steps.check.outputs.should-deploy }}
      pr-number: ${{ steps.check.outputs.pr-number }}
      pr-head-sha: ${{ steps.check.outputs.pr-head-sha }}
      pr-base-sha: ${{ steps.check.outputs.pr-base-sha }}
    steps:
      - name: Checkout base branch for security check
        uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Check deployment permissions
        id: check
        uses: actions/github-script@v8
        with:
          script: |
            const script = await import('${{ github.workspace }}/.github/scripts/check-deploy-permissions.ts');
            await script.default({ core, context, github });

  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    needs: check-permissions
    if: needs.check-permissions.outputs.should-deploy == 'true'
    steps:
      # warning: untrusted code, checkout the PR head only after auth check passed
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.check-permissions.outputs.pr-head-sha || github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0

      - uses: ./.github/workflows/setup

      - name: Install wrangler globally
        # The wrangler Action expects a global installation, so we better reuse
        # what we've in our project.
        run: |
          wrangler_version=$(cat package.json | jq -r '.pnpm.overrides.wrangler')
          pnpm install -g "wrangler@${wrangler_version}"

      # https://github.com/dorny/paths-filter/issues/232
      - uses: dorny/paths-filter@v3
        if: github.event_name != 'issue_comment'
        id: changes
        with:
          filters: |
            workflow: &workflow
              - '.github/workflows/deploy.yml'
              - '.github/workflows/deploy-worker/**'
            api: &api
              - *workflow
              - 'api/**'
              - 'shared/**'
            cdn: &cdn
              - *workflow
              - *api
              - 'components/**'
              - 'cdn/**'
            frontend:
              - *workflow
              - *api
              - *cdn
              - 'frontend/**'

      - name: Detect changes for issue_comment deployment
        if: github.event_name == 'issue_comment'
        id: changes-review
        run: |
          # Get the PR base and head SHAs from the check-permissions job outputs
          BASE_SHA=${{ needs.check-permissions.outputs.pr-base-sha }}
          HEAD_SHA=${{ needs.check-permissions.outputs.pr-head-sha }}

          # Get list of changed files in the PR
          CHANGED_FILES=$(git diff --name-only $BASE_SHA $HEAD_SHA)

          SHARED_CHANGED=$(echo "$CHANGED_FILES" | grep -qE '^(\.github/workflows/(deploy\.yml|deploy-worker/)|shared/)' && echo true || echo false)
          API_CHANGED=$(echo "$CHANGED_FILES" | grep -qE '^api/' && echo true || echo false)
          COMPONENTS_CHANGED=$(echo "$CHANGED_FILES" | grep -qE '^components/' && echo true || echo false)
          CDN_CHANGED=$(echo "$CHANGED_FILES" | grep -qE '^cdn/' && echo true || echo false)
          FRONTEND_CHANGED=$(echo "$CHANGED_FILES" | grep -qE '^frontend/' && echo true || echo false)

          if $SHARED_CHANGED || $API_CHANGED; then
            echo "api=true" >> $GITHUB_OUTPUT
          else
            echo "api=false" >> $GITHUB_OUTPUT
          fi

          if $SHARED_CHANGED || $API_CHANGED || $COMPONENTS_CHANGED || $CDN_CHANGED; then
            echo "cdn=true" >> $GITHUB_OUTPUT
          else
            echo "cdn=false" >> $GITHUB_OUTPUT
          fi

          if $SHARED_CHANGED || $API_CHANGED || $COMPONENTS_CHANGED || $CDN_CHANGED || $FRONTEND_CHANGED; then
            echo "frontend=true" >> $GITHUB_OUTPUT
          else
            echo "frontend=false" >> $GITHUB_OUTPUT
          fi

      - name: Get deploy mode
        id: deploy-mode
        run: |
          GH_EVENT_NAME='${{ github.event_name }}'
          GH_REF='${{ github.ref }}'
          mode="preview"
          if [[ "$GH_EVENT_NAME" == 'push' ]]; then
            [[ "$GH_REF" == 'refs/heads/main' ]] && mode="staging"
            [[ "$GH_REF" == 'refs/heads/release' ]] && mode="production"
          fi
          echo "mode=${mode}" >> $GITHUB_OUTPUT

      #region Deploy

      # cdn needs: API_URL, APP_URL (infer from API_URL to prevent cycle)
      # frontend (app) needs: CDN_URL, ?API_URL
      # api needs: nothing (APP_URL is passed from components)
      #
      # build/deploy sequence:
      # 1. api
      # 2. cdn
      # 3. frontend

      - name: Deploy API
        uses: ./.github/workflows/deploy-worker
        id: api
        with:
          name: 'api'
          changed: ${{ steps.changes.outputs.api || steps.changes-review.outputs.api }}
          mode: ${{ steps.deploy-mode.outputs.mode }}
          skip-deploy: 'false'
          BUILD_AWS_PREFIX: ${{ vars.AWS_PREFIX }}
          stagingUrl: ${{ vars.API_STAGING_URL }}
          productionUrl: ${{ vars.API_PRODUCTION_URL }}
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      - name: Deploy CDN
        uses: ./.github/workflows/deploy-worker
        id: cdn
        with:
          name: 'cdn'
          changed: ${{ steps.changes.outputs.cdn || steps.changes-review.outputs.cdn }}
          mode: ${{ steps.deploy-mode.outputs.mode }}
          skip-deploy: 'false'
          build: 'pnpm -C cdn run build'
          BUILD_API_URL: ${{ steps.api.outputs.url }}
          BUILD_AWS_PREFIX: ${{ vars.AWS_PREFIX }}
          stagingUrl: ${{ vars.CDN_STAGING_URL }}
          productionUrl: ${{ vars.CDN_PRODUCTION_URL }}
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      - name: Deploy Frontend
        uses: ./.github/workflows/deploy-worker
        id: frontend
        with:
          name: 'frontend'
          changed: ${{ steps.changes.outputs.frontend || steps.changes-review.outputs.frontend }}
          mode: ${{ steps.deploy-mode.outputs.mode }}
          skip-deploy: 'false'
          build: 'pnpm -C frontend run build'
          BUILD_API_URL: ${{ steps.api.outputs.url }}
          BUILD_CDN_URL: ${{ steps.cdn.outputs.url }}
          BUILD_AWS_PREFIX: ${{ vars.AWS_PREFIX }}
          stagingUrl: ${{ vars.APP_STAGING_URL }}
          productionUrl: ${{ vars.APP_PRODUCTION_URL }}
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
      #endregion

      #region Summary
      - name: Create Job summary
        if: always()
        uses: actions/github-script@v8
        id: summary
        with:
          script: |
            core.summary.addHeading('Deployment results', 'h2');

            core.summary.addRaw(`
            | Worker | Alias | URL  | Outcome |
            | ------ | --- | --- | --- |
            | API    | ${getTableText('${{ steps.api.outputs.url }}', '${{ steps.api.outputs.versioned-url }}', '${{ steps.api.outcome }}')} |
            | CDN    | ${getTableText('${{ steps.cdn.outputs.url }}', '${{ steps.cdn.outputs.versioned-url }}', '${{ steps.cdn.outcome }}')} |
            | App    | ${getTableText('${{ steps.frontend.outputs.url }}', '${{ steps.frontend.outputs.versioned-url }}', '${{ steps.frontend.outcome }}')} |
            `, true);

            const repoUrl = '${{ github.server_url }}/${{ github.repository }}';
            const runId = '${{ github.run_id }}';
            core.summary.addSeparator();
            core.summary.addLink(`Logs #${runId}`, `${repoUrl}/actions/runs/${runId}`);

            await core.setOutput('summary', core.summary.stringify());
            await core.summary.write();

            function getTableText(url, versionedUrl, outcome) {
              if (outcome !== 'success') {
                return ['-', '-', outcome].join(' | ');
              }
              return [
                url !== versionedUrl ? getUrlText(url, outcome) : '-',
                getUrlText(versionedUrl, outcome),
                outcome,
              ].join(' | ');
            }

            function getUrlText(url, outcome) {
              if (url) {
                const RE = /^https?:\/\/([a-z0-9]+)-/i;
                const text = url.match(RE)?.[1] ?? url;
                return `[${text}](${url})`;
              }
              return outcome;
            }

      - name: Create deploy comment
        if: github.event_name == 'pull_request' || github.event_name == 'issue_comment'
        continue-on-error: true
        uses: edumserrano/find-create-or-update-comment@v3
        with:
          issue-number: ${{ github.event.pull_request.number || needs.check-permissions.outputs.pr-number }}
          body-includes: '<!-- worker-deploy-summary -->'
          comment-author: 'github-actions[bot]'
          body: |
            <!-- worker-deploy-summary -->
            ${{ steps.summary.outputs.summary }}
          edit-mode: replace
    #endregion