| 1 | name: Deploy |
| 2 | |
| 3 | # Deploys diffinery.com from main. Uses the repository secrets |
| 4 | # CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID; optional repository variable |
| 5 | # ACCESS_TEAM_DOMAIN (e.g. codician.cloudflareaccess.com). |
| 6 | on: |
| 7 | push: |
| 8 | branches: [main] |
| 9 | workflow_dispatch: |
| 10 | |
| 11 | permissions: |
| 12 | contents: read |
| 13 | |
| 14 | concurrency: |
| 15 | group: deploy-production |
| 16 | cancel-in-progress: false |
| 17 | |
| 18 | jobs: |
| 19 | deploy: |
| 20 | name: Deploy to Cloudflare |
| 21 | runs-on: ubuntu-latest |
| 22 | timeout-minutes: 45 |
| 23 | environment: |
| 24 | name: production |
| 25 | url: https://diffinery.com |
| 26 | env: |
| 27 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 28 | CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |
| 29 | ACCESS_TEAM_DOMAIN: ${{ vars.ACCESS_TEAM_DOMAIN }} |
| 30 | steps: |
| 31 | - uses: actions/checkout@v4 |
| 32 | - uses: pnpm/action-setup@v4 |
| 33 | - uses: actions/setup-node@v4 |
| 34 | with: |
| 35 | node-version: 22 |
| 36 | cache: pnpm |
| 37 | - run: pnpm install --frozen-lockfile |
| 38 | - name: Build runner agent |
| 39 | run: pnpm --filter @diffinery/runner build |
| 40 | - name: Typecheck and test |
| 41 | run: pnpm -r --if-present typecheck && pnpm -r --if-present test |
| 42 | |
| 43 | - name: Create or update Cloudflare resources |
| 44 | id: bootstrap |
| 45 | run: scripts/bootstrap.sh |
| 46 | |
| 47 | - name: Deploy Worker and runner image |
| 48 | working-directory: apps/diffinery |
| 49 | run: pnpm exec wrangler deploy -c wrangler.deploy.jsonc |
| 50 | |
| 51 | - name: Generate Worker secrets (first deploy only) |
| 52 | run: scripts/ensure-secrets.sh |
| 53 | |
| 54 | - name: Finish Access setup on first deploy |
| 55 | if: steps.bootstrap.outputs.access_team == '' |
| 56 | run: | |
| 57 | scripts/bootstrap.sh |
| 58 | cd apps/diffinery && pnpm exec wrangler deploy -c wrangler.deploy.jsonc --containers-rollout none |
| 59 | |
| 60 | - name: Smoke test |
| 61 | run: | |
| 62 | # A new custom domain can take a few minutes to get its certificate. |
| 63 | for i in $(seq 1 30); do |
| 64 | code=$(curl -s -o /dev/null -w '%{http_code}' https://diffinery.com/healthz) && [ "$code" = 200 ] && exit 0 |
| 65 | sleep 10 |
| 66 | done |
| 67 | echo "::error::https://diffinery.com/healthz did not return 200 (last: $code)"; exit 1 |