bot-deploy.yml

name: Bot Deploy

on:
  workflow_dispatch:
    inputs:
      environment:
        description: Deployment environment
        required: true
        default: staging
        type: choice
        options:
          - staging
          - production
      target:
        description: Deploy target
        required: true
        default: render
        type: choice
        options:
          - render
          - cloudflare
          - both
      branch:
        description: Git branch to deploy on Render
        required: true
        default: stage1
        type: string
      test_deployment:
        description: Deploy Render test service name
        required: true
        default: false
        type: boolean
      with_render_smoke:
        description: Run Render full-stack smoke after deploy
        required: true
        default: false
        type: boolean
      with_cloudflare_smoke:
        description: Run Cloudflare smoke after deploy
        required: true
        default: false
        type: boolean
      dry_run:
        description: Run deploy checks only (no service mutation/deploy trigger)
        required: true
        default: false
        type: boolean

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ github.event.inputs.environment }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install
        run: npm ci

      - name: Deploy
        shell: bash
        env:
          BOT_SECRETS_ENV_ONLY: "true"
          BOT_ENV: ${{ github.event.inputs.environment }}
          RENDER_DEPLOY_METADATA_OUT: telegram/out/deploy-render-metadata.${{ github.event.inputs.environment }}.json
          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
          RENDER_OWNER_ID: ${{ secrets.RENDER_OWNER_ID }}
          RENDER_REGION: ${{ secrets.RENDER_REGION }}
          RENDER_PLAN: ${{ secrets.RENDER_PLAN }}
          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          TELEGRAM_WEBHOOK_SECRET: ${{ secrets.TELEGRAM_WEBHOOK_SECRET }}
          TELEGRAM_NOTIFY_CHAT_ID: ${{ secrets.TELEGRAM_NOTIFY_CHAT_ID }}
          TELEGRAM_TEST_CHAT_ID: ${{ secrets.TELEGRAM_TEST_CHAT_ID }}
          TELEGRAM_ADMIN_CHAT_IDS: ${{ secrets.TELEGRAM_ADMIN_CHAT_IDS }}
          COMICBOT_ALLOWED_CHAT_IDS: ${{ secrets.COMICBOT_ALLOWED_CHAT_IDS }}
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
          HUGGINGFACE_INFERENCE_API_TOKEN: ${{ secrets.HUGGINGFACE_INFERENCE_API_TOKEN }}
          COHERE_API_KEY: ${{ secrets.COHERE_API_KEY }}
          FIRECRAWL_API_KEY: ${{ secrets.FIRECRAWL_API_KEY }}
          JINA_API_KEY: ${{ secrets.JINA_API_KEY }}
          DRIFTBOT_API_KEY: ${{ secrets.DRIFTBOT_API_KEY }}
          BRAVE_SEARCH_API_KEY: ${{ secrets.BRAVE_SEARCH_API_KEY }}
          TAVILY_API_KEY: ${{ secrets.TAVILY_API_KEY }}
          EXA_API_KEY: ${{ secrets.EXA_API_KEY }}
          SERPER_API_KEY: ${{ secrets.SERPER_API_KEY }}
          SERPAPI_API_KEY: ${{ secrets.SERPAPI_API_KEY }}
          GOOGLE_KG_API_KEY: ${{ secrets.GOOGLE_KG_API_KEY }}
          LLAMA_CLOUD_API_KEY: ${{ secrets.LLAMA_CLOUD_API_KEY }}
          UNSTRUCTURED_API_KEY: ${{ secrets.UNSTRUCTURED_API_KEY }}
          ASSEMBLYAI_API_KEY: ${{ secrets.ASSEMBLYAI_API_KEY }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          CLOUDFLARE_WORKERS_AI_TOKEN: ${{ secrets.CLOUDFLARE_WORKERS_AI_TOKEN }}
          CLOUDFLARE_ACCOUNT_API_TOKEN: ${{ secrets.CLOUDFLARE_ACCOUNT_API_TOKEN }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_WORKERS_AI_TOKEN }}
          R2_S3_ENDPOINT: ${{ secrets.R2_S3_ENDPOINT }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
        run: |
          set -euo pipefail
          npm run secrets:validate:deploy:ci
          EXTRA_ARGS=()
          EXTRA_ARGS+=(--env "${{ github.event.inputs.environment }}")
          EXTRA_ARGS+=(--target "${{ github.event.inputs.target }}")
          EXTRA_ARGS+=(--branch "${{ github.event.inputs.branch }}")
          EXTRA_ARGS+=(--env-only)
          EXTRA_ARGS+=(--skip-local-tests)

          if [[ "${{ github.event.inputs.test_deployment }}" == "true" ]]; then
            EXTRA_ARGS+=(--test-deployment)
          fi
          if [[ "${{ github.event.inputs.with_render_smoke }}" == "true" ]]; then
            EXTRA_ARGS+=(--with-render-smoke)
          fi
          if [[ "${{ github.event.inputs.with_cloudflare_smoke }}" == "true" ]]; then
            EXTRA_ARGS+=(--with-cloudflare-smoke)
          fi
          if [[ "${{ github.event.inputs.dry_run }}" == "true" ]]; then
            EXTRA_ARGS+=(--dry-run)
          fi

          npm run bot:deploy:auto -- "${EXTRA_ARGS[@]}"