name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  pages: write
  id-token: write

# The Worker deploy is idempotent (wrangler uploads the whole bundle), so on a
# burst of pushes only the last one matters: cancel-in-progress is correct for
# both the Pages build and the Worker job.
concurrency:
  group: deploy
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22 # Blume requires 22.12+

      - uses: oven-sh/setup-bun@v2 # skip if you use npm/pnpm

      - run: bun install --frozen-lockfile
      # blume.config.ts pulls the /changelog pages from this repo's GitHub
      # releases (githubReleases source) at build time. The token authenticates
      # that fetch — required if the repo is private, and it lifts the shared
      # runner's unauthenticated API rate limit. `contents: read` covers it.
      - run: bun run build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/upload-pages-artifact@v3
        with:
          path: apps/docs/dist

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - id: deployment
        uses: actions/deploy-pages@v4

  # Deploys on every main push (not path-filtered): apps/api/data/schedule.json
  # is bundled at deploy time, and re-deploying an unchanged Worker is a no-op.
  # Needs repo secrets CLOUDFLARE_API_TOKEN (Workers Scripts: Edit),
  # CLOUDFLARE_ACCOUNT_ID, and OPENROUTER_API_KEY (the docs assistant's
  # POST /ask; the Actions secret is the one copy, mirrored into the Worker).
  deploy-api:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2

      - run: bun install --frozen-lockfile

      # DST cron guards must hold before the Worker ships.
      - run: bun run api:test

      - run: printf %s "$OPENROUTER_API_KEY" | bunx wrangler secret put OPENROUTER_API_KEY
        working-directory: apps/api
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}

      - run: bun run api:deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}