| 1 | name: Deploy |
| 2 | |
| 3 | # Deploys diffinery.com from main. Uses the repository secrets |
| 4 | # CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID; optional repository variable |
| 5 | # ACCESS_TEAM_DOMAIN (e.g. codician.cloudflareaccess.com). |
| 6 | on: |
| 7 | push: |
| 8 | branches: [main] |
| 9 | workflow_dispatch: |
| 10 | |
| 11 | permissions: |
| 12 | contents: read |
| 13 | |
| 14 | concurrency: |
| 15 | group: deploy-production |
| 16 | cancel-in-progress: false |
| 17 | |
| 18 | jobs: |
| 19 | deploy: |
| 20 | name: Deploy to Cloudflare |
| 21 | runs-on: ubuntu-latest |
| 22 | timeout-minutes: 45 |
| 23 | environment: |
| 24 | name: production |
| 25 | url: https://diffinery.com |
| 26 | env: |
| 27 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 28 | CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |
| 29 | ACCESS_TEAM_DOMAIN: ${{ vars.ACCESS_TEAM_DOMAIN }} |
| 30 | steps: |
| 31 | - uses: actions/checkout@v4 |
| 32 | - uses: pnpm/action-setup@v4 |
| 33 | - uses: actions/setup-node@v4 |
| 34 | with: |
| 35 | node-version: 22 |
| 36 | cache: pnpm |
| 37 | - run: pnpm install --frozen-lockfile |
| 38 | - name: Build runner agent and web islands |
| 39 | run: pnpm -r --if-present build |
| 40 | - name: Typecheck and test |
| 41 | run: pnpm -r --if-present typecheck && pnpm -r --if-present test |
| 42 | |
| 43 | - name: Create or update Cloudflare resources |
| 44 | id: bootstrap |
| 45 | run: scripts/bootstrap.sh |
| 46 | |
| 47 | - name: Deploy Worker and runner image |
| 48 | working-directory: apps/diffinery |
| 49 | run: pnpm exec wrangler deploy -c wrangler.deploy.jsonc |
| 50 | |
| 51 | - name: Generate Worker secrets (first deploy only) |
| 52 | run: scripts/ensure-secrets.sh |
| 53 | |
| 54 | - name: Finish Access setup on first deploy |
| 55 | if: steps.bootstrap.outputs.access_team == '' |
| 56 | run: | |
| 57 | scripts/bootstrap.sh |
| 58 | cd apps/diffinery && pnpm exec wrangler deploy -c wrangler.deploy.jsonc --containers-rollout none |
| 59 | |
| 60 | - name: Smoke test |
| 61 | run: | |
| 62 | # A new custom domain can take a few minutes to get its certificate. |
| 63 | for i in $(seq 1 30); do |
| 64 | code=$(curl -s -o /dev/null -w '%{http_code}' https://diffinery.com/healthz) && [ "$code" = 200 ] && exit 0 |
| 65 | sleep 10 |
| 66 | done |
| 67 | echo "::error::https://diffinery.com/healthz did not return 200 (last: $code). Check that the diffinery.com DNS record is proxied (orange cloud)."; exit 1 |
| 68 | |
| 69 | - name: Check sign-in pages |
| 70 | run: | |
| 71 | set -u |
| 72 | page=$(curl -sS https://diffinery.com/login) |
| 73 | grep -q "Sign in with a passkey" <<<"$page" || { echo "::error::/login is not the Diffinery sign-in page"; exit 1; } |
| 74 | echo "/login serves the passkey sign-in page" |
| 75 | loc=$(curl -sS -o /dev/null -w '%{http_code} %{redirect_url}' https://diffinery.com/auth/access) |
| 76 | echo "/auth/access -> $loc" |
| 77 | [[ "$loc" == 302\ https://*.cloudflareaccess.com/* ]] || echo "::warning::/auth/access is not behind Cloudflare Access yet, so email recovery and first admin sign-in will not work" |
| 78 | for kind in js css; do |
| 79 | asset=$(grep -o "/-/kumo/[a-z0-9]*\.$kind" <<<"$page" | head -1) |
| 80 | [ -n "$asset" ] || { echo "::error::/login does not load the Kumo $kind bundle"; exit 1; } |
| 81 | code=$(curl -sS -o /dev/null -w '%{http_code}' "https://diffinery.com$asset") |
| 82 | [ "$code" = 200 ] || { echo "::error::$asset returned $code"; exit 1; } |
| 83 | echo "$asset -> 200" |
| 84 | done |