deploy-api.yml

name: Deploy API Worker
on:
  push:
    branches: [main]
    paths:
      - 'workers/api/**'
      - 'packages/sdk/**'
      - '.github/workflows/deploy-api.yml'
      # The build chain moved OUT of this file into a composite action (#779). Without this
      # entry an edit to the shared chain would trigger no deploy at all — the duplication it
      # replaced was at least watched, because it lived in the path above.
      - '.github/actions/build-platform/**'
  workflow_dispatch: {}

concurrency:
  group: deploy-api
  cancel-in-progress: true

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # `pnpm test` below now includes migration-hygiene.test.ts, which shells out to
          # check-migrations.mjs --require-history. That guard REFUSES a shallow clone by
          # design: a history-dependent check with no history passes by verifying nothing,
          # so it fails loudly instead. Depth 1 therefore red-lined this deploy from the
          # commit the guard landed in (48eb443) — the API fixes were merged and undeployed
          # while Deploy Host stayed green, so the console looked fine and the worker was stale.
          fetch-depth: 0
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      # The install + build chain shared with deploy-host.yml and (still hand-rolled) ci.yml.
      # Must come AFTER pnpm/action-setup and setup-node above — the composite shells out to
      # `pnpm` directly and has no setup of its own.
      #
      # Why an API deploy builds the CONSOLE and the HOST pages at all: `pnpm test` below runs
      # the WHOLE suite. It imports @proagentstore/sdk through its exports map (its built dist),
      # and it collects workers/host/src/admin-api-proxy.test.ts, which imports the host worker's
      # index.ts, which imports ./pages.js at module load. `pages.ts` is build output that
      # build.js inlines store/ into, and build.js reads the console and admin Vite bundles and
      # the generated store/docs. Miss any link and the deploy stops for a reason unrelated to
      # the API — which is exactly what happened when this chain was hand-copied without the
      # docs steps: run 34004410070 died at `node build.js` with "No docs at store/docs", fixed
      # in 0ca213b3. Extracting the chain (#779) is what stops the copy existing to go stale.
      - uses: ./.github/actions/build-platform

      - name: Run tests
        run: pnpm test

      - name: Apply D1 migrations
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          workingDirectory: workers/api
          command: d1 migrations apply pags --remote

      - name: Deploy API worker
        # --var API_BUILD overrides the wrangler.toml "dev" default with the real 12-char git SHA
        # (#735) so every server-side error_log row carries the build that wrote it. 12 chars
        # matches the client-side convention from #539 and is collision-free in practice (the
        # birthday bound is ~2^48, orders of magnitude beyond any realistic repo history).
        run: |
          SHORT_SHA=$(git rev-parse --short=12 HEAD)
          cd workers/api && pnpm exec wrangler deploy --var "API_BUILD:${SHORT_SHA}"
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      - name: Smoke test
        run: |
          for i in 1 2 3 4 5; do
            STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://api.proagentstore.online/health)
            if [ "$STATUS" = "200" ]; then
              echo "Health check passed"
              exit 0
            fi
            echo "Attempt $i: got $STATUS, retrying..."
            sleep 5
          done
          echo "Health check failed after 5 attempts"
          exit 1