name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

# Both Workers deploy idempotently (wrangler uploads the whole bundle and
# only changed assets), so on a burst of pushes only the last one matters:
# cancel-in-progress is correct for both jobs.
concurrency:
  group: deploy
  cancel-in-progress: true

jobs:
  # The docs site: a Blume `cloudflare()` server build (apps/docs/blume.config.ts)
  # deployed as the `prdcs-wiki` Worker on the prdcs.wiki custom domain
  # (apps/docs/wrangler.jsonc). Needs CLOUDFLARE_API_TOKEN to also carry
  # Workers Routes: Edit on the prdcs.wiki zone for the custom domain.
  deploy-docs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22 # Blume requires 22.12+

      - uses: oven-sh/setup-bun@v2

      - run: bun install --frozen-lockfile
      # pages/changelog.astro reads this repo's GitHub releases at build time
      # (apps/docs/lib/releases.ts). The token authenticates that fetch —
      # required if the repo is private, and it lifts the shared runner's
      # unauthenticated API rate limit. `contents: read` covers it.
      - run: bun run build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # `blume build` writes .wrangler/deploy/config.json, which points
      # wrangler at the built dist/server/wrangler.json.
      - run: bun run docs:deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

  # Deploys on every main push (not path-filtered): apps/api/data/schedule.json
  # is bundled at deploy time, and re-deploying an unchanged Worker is a no-op.
  # Needs repo secrets CLOUDFLARE_API_TOKEN (Workers Scripts: Edit),
  # CLOUDFLARE_ACCOUNT_ID, and OPENROUTER_API_KEY (the docs assistant's
  # POST /ask; the Actions secret is the one copy, mirrored into the Worker).
  deploy-api:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2

      - run: bun install --frozen-lockfile

      # DST cron guards must hold before the Worker ships.
      - run: bun run api:test

      - run: printf %s "$OPENROUTER_API_KEY" | bunx wrangler secret put OPENROUTER_API_KEY
        working-directory: apps/api
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}

      - run: bun run api:deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}