name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

# The Worker only. The docs site is built and published from prdlk/cs, which
# reads docs/ from this repo over HTTP (Blume's mdxRemote()), so this repo has
# no Pages build.
permissions:
  contents: read

# The Worker deploy is idempotent (wrangler uploads the whole bundle), so on a
# burst of pushes only the last one matters: cancel-in-progress is correct.
concurrency:
  group: deploy
  cancel-in-progress: true

jobs:
  # Deploys on every main push (not path-filtered): apps/api/data/schedule.json
  # is bundled at deploy time, and re-deploying an unchanged Worker is a no-op.
  # Needs repo secrets CLOUDFLARE_API_TOKEN (Workers Scripts: Edit),
  # CLOUDFLARE_ACCOUNT_ID, and OPENROUTER_API_KEY (the docs assistant's
  # POST /ask; the Actions secret is the one copy, mirrored into the Worker).
  deploy-api:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2

      - run: bun install --frozen-lockfile

      # DST cron guards must hold before the Worker ships.
      - run: bun run api:test

      - run: printf %s "$OPENROUTER_API_KEY" | bunx wrangler secret put OPENROUTER_API_KEY
        working-directory: apps/api
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}

      - run: bun run api:deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}