deploy.yml

name: Deploy

# Publishes the commit CI just passed on `main`, then tests the live site. Starting
# it by hand republishes `main`, for example after changing a sign-in ID below, which
# is built into the app. A commit `main` has moved past is never published.
#
# `workflow_run` runs with this repository's secrets whatever started CI, and a fork's
# pull request from a branch named `main` also matches the branch filter, so the event
# and repository checks below are what keep such a run out.
on:
  workflow_run:
    workflows: [CI]
    types: [completed]
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

# Never two at once: they would race to publish, and the live tests reset one branch.
concurrency:
  group: deploy
  cancel-in-progress: false

jobs:
  # Re-running an older CI run ends in the same success as a new one, and publishing
  # it would roll the live site back while every test passes against the old code.
  # This runs inside the concurrency group, so a queued run compares with the main of
  # its own turn. Failing to read main stops the run rather than publishing.
  check-tip:
    if: >-
      github.repository == 'tiennm99dev/gitnote' && (
        (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') ||
        (github.event.workflow_run.conclusion == 'success' &&
         github.event.workflow_run.event == 'push' &&
         github.event.workflow_run.head_repository.full_name == github.repository)
      )
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      is-tip: ${{ steps.compare.outputs.is-tip }}
    steps:
      - name: Compare this commit with the tip of main
        id: compare
        run: |
          tip=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq .object.sha)
          if [ -z "$tip" ]; then
            echo '::error::GitHub returned no commit for main.'
            exit 1
          fi
          if [ "$tip" = "$COMMIT" ]; then
            echo 'is-tip=true' >> "$GITHUB_OUTPUT"
          else
            echo "::notice::Not publishing $COMMIT, because main has moved on to $tip."
            echo 'is-tip=false' >> "$GITHUB_OUTPUT"
          fi
        env:
          COMMIT: ${{ github.event.workflow_run.head_sha || github.sha }}
          GH_TOKEN: ${{ github.token }}

  deploy:
    needs: check-tip
    if: needs.check-tip.outputs.is-tip == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Warn about missing sign-in IDs
        env:
          CLIENT_ID_GITHUB: ${{ vars.VITE_GITHUB_CLIENT_ID }}
          CLIENT_ID_GITLAB: ${{ vars.VITE_GITLAB_CLIENT_ID }}
        run: |
          [ -n "$CLIENT_ID_GITHUB" ] || echo "::warning::VITE_GITHUB_CLIENT_ID is not set, so this deploy has no GitHub sign-in button."
          [ -n "$CLIENT_ID_GITLAB" ] || echo "::warning::VITE_GITLAB_CLIENT_ID is not set, so this deploy has no GitLab sign-in button."

      # The IDs are public, and blank ones turn that provider's sign-in button off.
      - name: Build the web app
        run: npm run build -w app
        env:
          VITE_GITHUB_CLIENT_ID: ${{ vars.VITE_GITHUB_CLIENT_ID }}
          VITE_GITHUB_APP_SLUG: ${{ vars.VITE_GITHUB_APP_SLUG }}
          VITE_GITLAB_CLIENT_ID: ${{ vars.VITE_GITLAB_CLIENT_ID }}

      # The token appears in this step alone, so the build's packages never see it.
      - name: Deploy the Worker
        run: |
          [ -n "$CLOUDFLARE_API_TOKEN" ] || { echo '::error::The CLOUDFLARE_API_TOKEN secret is not set; see Deploying in README.md.'; exit 1; }
          [ -n "$CLOUDFLARE_ACCOUNT_ID" ] || { echo '::error::The CLOUDFLARE_ACCOUNT_ID variable is not set; see Deploying in README.md.'; exit 1; }
          npm run deploy -w relay
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}

  # Every deploy gets the smoke tests, which need no credentials. This job uploads
  # nothing: a Playwright run with a token must publish no artifacts.
  live-e2e:
    needs: deploy
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Smoke test the live site
        run: npm run e2e:live -w app -- smoke.live.js
        env:
          CHROMIUM_PATH: /usr/bin/google-chrome

      # Skipped until the test repo is named. Its token reaches only this step.
      - name: Test a note round trip on the live site
        if: vars.GITNOTE_E2E_REPO != ''
        run: |
          if [ -z "$GITNOTE_E2E_TOKEN" ]; then
            echo '::error::GITNOTE_E2E_REPO is set but the GITNOTE_E2E_TOKEN secret is not.'
            exit 1
          fi
          npm run e2e:live -w app -- notes.live.js
        env:
          CHROMIUM_PATH: /usr/bin/google-chrome
          GITNOTE_E2E_REPO: ${{ vars.GITNOTE_E2E_REPO }}
          GITNOTE_E2E_TOKEN: ${{ secrets.GITNOTE_E2E_TOKEN }}