| 1 | name: Deploy |
| 2 | |
| 3 | # Deploys Diffinery from main. Uses the repository secrets |
| 4 | # CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID, and these optional repository |
| 5 | # variables (the same ones scripts/bootstrap.sh reads): |
| 6 | # DIFFINERY_DOMAIN where it is served (default diffinery.com) |
| 7 | # DIFFINERY_ZONE the Cloudflare zone for the route (default: the domain's last two labels) |
| 8 | # MAIL_DOMAIN sends from notifications@<MAIL_DOMAIN> (default DIFFINERY_DOMAIN) |
| 9 | # ACCESS_TEAM_DOMAIN e.g. example.cloudflareaccess.com |
| 10 | # |
| 11 | # It deploys a main commit only once CI (typecheck, unit tests and the Worker bundle) has |
| 12 | # passed on it, so it doesn't run those itself. End-to-end tests run alongside the deploy. |
| 13 | # Only main's current tip deploys: re-running an old CI run (which anyone with write access |
| 14 | # can do) doesn't bring back a version from before a fix. |
| 15 | # |
| 16 | # The Cloudflare secrets are the production environment's, and only the steps that talk to |
| 17 | # Cloudflare get them: installs, builds and third-party actions run without them. |
| 18 | on: |
| 19 | workflow_run: |
| 20 | workflows: [CI] |
| 21 | types: [completed] |
| 22 | branches: [main] |
| 23 | workflow_dispatch: |
| 24 | |
| 25 | permissions: |
| 26 | contents: read |
| 27 | |
| 28 | concurrency: |
| 29 | group: deploy-production |
| 30 | cancel-in-progress: false |
| 31 | |
| 32 | jobs: |
| 33 | gate: |
| 34 | name: Main's current tip |
| 35 | # Production deploys from Diffinery itself, on its own hosted runners (any |
| 36 | # Diffinery, so self-hosted copies deploy themselves too). Running this |
| 37 | # workflow by hand on GitHub still deploys, as a fallback. |
| 38 | if: ${{ github.event_name == 'workflow_dispatch' || (github.server_url != 'https://github.com' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push') }} |
| 39 | runs-on: ubuntu-latest |
| 40 | timeout-minutes: 5 |
| 41 | outputs: |
| 42 | deploy: ${{ steps.tip.outputs.deploy }} |
| 43 | steps: |
| 44 | - name: Deploy only main's current tip |
| 45 | id: tip |
| 46 | env: |
| 47 | GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 48 | WANT: ${{ github.event.workflow_run.head_sha || github.sha }} |
| 49 | REF: ${{ github.ref }} |
| 50 | run: | |
| 51 | set -euo pipefail |
| 52 | if [ "$GITHUB_EVENT_NAME" = workflow_dispatch ] && [ "$REF" != refs/heads/main ]; then |
| 53 | echo "::error::Deploy runs from main only (this run is on $REF)"; exit 1 |
| 54 | fi |
| 55 | tip=$(curl -fsS "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/branches/main" -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" | jq -r .commit.sha) |
| 56 | if [ "$tip" = "$WANT" ]; then |
| 57 | echo "deploy=true" >> "$GITHUB_OUTPUT" |
| 58 | echo "deploying $WANT, main's tip" |
| 59 | else |
| 60 | # A later commit's CI run deploys it: a re-run of an old CI run deploys nothing. |
| 61 | echo "deploy=false" >> "$GITHUB_OUTPUT" |
| 62 | echo "::notice::not deploying $WANT: main is at $tip now, and that commit's own run deploys it" |
| 63 | fi |
| 64 | |
| 65 | deploy: |
| 66 | name: Deploy to Cloudflare |
| 67 | needs: gate |
| 68 | if: ${{ needs.gate.outputs.deploy == 'true' }} |
| 69 | runs-on: ubuntu-latest |
| 70 | timeout-minutes: 45 |
| 71 | environment: |
| 72 | name: production |
| 73 | url: https://${{ vars.DIFFINERY_DOMAIN || 'diffinery.com' }} |
| 74 | env: |
| 75 | DIFFINERY_DOMAIN: ${{ vars.DIFFINERY_DOMAIN || 'diffinery.com' }} |
| 76 | DIFFINERY_ZONE: ${{ vars.DIFFINERY_ZONE }} |
| 77 | MAIL_DOMAIN: ${{ vars.MAIL_DOMAIN }} |
| 78 | ACCESS_TEAM_DOMAIN: ${{ vars.ACCESS_TEAM_DOMAIN }} |
| 79 | # Who becomes site administrator on first sign-in. Unset keeps the deployed Worker's list (scripts/bootstrap-admins.sh). |
| 80 | BOOTSTRAP_ADMINS: ${{ vars.BOOTSTRAP_ADMINS }} |
| 81 | steps: |
| 82 | - uses: actions/checkout@v4 |
| 83 | with: |
| 84 | # The commit CI passed on, not whatever main is by now. |
| 85 | ref: ${{ github.event.workflow_run.head_sha || github.sha }} |
| 86 | - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 |
| 87 | - uses: actions/setup-node@v4 |
| 88 | with: |
| 89 | node-version: 22 |
| 90 | cache: pnpm |
| 91 | - run: pnpm install --frozen-lockfile |
| 92 | - name: Build runner agent and web islands |
| 93 | run: pnpm -r --if-present build |
| 94 | - name: Runner image (built only when the runner changed) |
| 95 | env: |
| 96 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 97 | CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |
| 98 | run: scripts/runner-image.sh |
| 99 | |
| 100 | - name: Create or update Cloudflare resources |
| 101 | id: bootstrap |
| 102 | env: |
| 103 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 104 | CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |
| 105 | run: scripts/bootstrap.sh |
| 106 | |
| 107 | - name: Deploy Worker and runner image |
| 108 | working-directory: apps/diffinery |
| 109 | env: |
| 110 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 111 | CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |
| 112 | run: pnpm exec wrangler deploy -c wrangler.deploy.jsonc |
| 113 | |
| 114 | - name: Wait for new containers to get the new image |
| 115 | env: |
| 116 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 117 | CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |
| 118 | # The Live test follows this workflow, and its checks must run on the new image. |
| 119 | # This job runs on an old-image container, so finishing after the rollout's last step |
| 120 | # also shows that a deploy doesn't stop a running job. |
| 121 | run: scripts/wait-container-rollout.sh |
| 122 | |
| 123 | - name: Worker secrets (generated on the first deploy; TURNSTILE_SECRET when missing) |
| 124 | env: |
| 125 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 126 | CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |
| 127 | run: scripts/ensure-secrets.sh |
| 128 | |
| 129 | - name: Finish Access setup on first deploy |
| 130 | if: steps.bootstrap.outputs.access_team == '' |
| 131 | env: |
| 132 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 133 | CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |
| 134 | run: | |
| 135 | scripts/bootstrap.sh |
| 136 | cd apps/diffinery && pnpm exec wrangler deploy -c wrangler.deploy.jsonc --containers-rollout none |
| 137 | |
| 138 | - name: Smoke test |
| 139 | run: | |
| 140 | # A new custom domain can take a few minutes to get its certificate. |
| 141 | for i in $(seq 1 30); do |
| 142 | code=$(curl -s -o /dev/null -w '%{http_code}' https://$DIFFINERY_DOMAIN/healthz) && [ "$code" = 200 ] && exit 0 |
| 143 | sleep 10 |
| 144 | done |
| 145 | echo "::error::https://$DIFFINERY_DOMAIN/healthz did not return 200 (last: $code). Check that the $DIFFINERY_DOMAIN DNS record is proxied (orange cloud)."; exit 1 |
| 146 | |
| 147 | - name: Check sign-in pages |
| 148 | run: | |
| 149 | set -u |
| 150 | page=$(curl -sS https://$DIFFINERY_DOMAIN/login) |
| 151 | grep -q "Sign in with a passkey" <<<"$page" || { echo "::error::/login is not the Diffinery sign-in page"; exit 1; } |
| 152 | echo "/login serves the passkey sign-in page" |
| 153 | loc=$(curl -sS -o /dev/null -w '%{http_code} %{redirect_url}' https://$DIFFINERY_DOMAIN/auth/access) |
| 154 | echo "/auth/access -> $loc" |
| 155 | [[ "$loc" == 302\ https://*.cloudflareaccess.com/* ]] || echo "::warning::/auth/access is not behind Cloudflare Access yet, so email recovery and first admin sign-in will not work" |
| 156 | report=$(curl -sS -w '\n%{http_code}' https://$DIFFINERY_DOMAIN/security/report) |
| 157 | code=${report##*$'\n'} |
| 158 | if grep -q 'class="cf-turnstile"' <<<"$report"; then |
| 159 | echo "/security/report shows Turnstile to people who aren't signed in" |
| 160 | elif grep -q 'has no Turnstile configured' <<<"$report"; then |
| 161 | echo "::warning::/security/report has no Turnstile, so only people who are signed in can send security reports: the Worker lacks TURNSTILE_SITE_KEY or TURNSTILE_SECRET (see the bootstrap and Worker secrets steps)" |
| 162 | else |
| 163 | echo "::warning::/security/report has no Turnstile, so only people who are signed in can send security reports: it answered $code without the form" |
| 164 | fi |
| 165 | for kind in js css; do |
| 166 | asset=$(grep -o "/-/kumo/[a-z0-9]*\.$kind" <<<"$page" | head -1) |
| 167 | [ -n "$asset" ] || { echo "::error::/login does not load the Kumo $kind bundle"; exit 1; } |
| 168 | code=$(curl -sS -o /dev/null -w '%{http_code}' "https://$DIFFINERY_DOMAIN$asset") |
| 169 | [ "$code" = 200 ] || { echo "::error::$asset returned $code"; exit 1; } |
| 170 | echo "$asset -> 200" |
| 171 | done |
| 172 | - name: Check favicon and search metadata |
| 173 | run: | |
| 174 | set -u |
| 175 | for p in /favicon.ico /favicon.svg /favicon-48.png /apple-touch-icon.png /og-image.png /site.webmanifest /robots.txt /sitemap.xml; do |
| 176 | code=$(curl -sS -o /dev/null -w '%{http_code} %{content_type}' "https://$DIFFINERY_DOMAIN$p") |
| 177 | [[ "$code" == 200\ * ]] || { echo "::error::$p returned $code"; exit 1; } |
| 178 | echo "$p -> $code" |
| 179 | done |
| 180 | home=$(curl -sS https://$DIFFINERY_DOMAIN/) |
| 181 | for tag in 'rel="icon" href="/favicon.ico"' 'property="og:image"' 'rel="canonical"' 'application/ld+json'; do |
| 182 | grep -qF "$tag" <<<"$home" || { echo "::error::the home page is missing $tag"; exit 1; } |
| 183 | done |
| 184 | echo "the home page carries the favicon, canonical, Open Graph and structured data tags" |
| 185 | bm=$(curl -sS -D - -o /dev/null https://$DIFFINERY_DOMAIN/sitemap.xml | tr -d '\r' | sed -n 's/^x-d1-bookmark: //Ip') |
| 186 | [ -n "$bm" ] || { echo "::error::D1 queries don't run in a session (no x-d1-bookmark header)"; exit 1; } |
| 187 | echo "D1 sessions are on (bookmark $bm)" |