deploy-pages.yml

name: Deploy to GitHub Pages

on:
  push:
    branches: [main]
  # Run on PRs too so the `build` job reports its required status check — the
  # `build` context is a required check on main, but it previously only ran on
  # push, so no PR could ever satisfy it (every PR sat BLOCKED). The deploy job
  # below is gated to non-PR events so PRs build but never publish to Pages.
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  pages: write
  id-token: write

concurrency:
  # Ref-scoped so a PR build can't cancel an in-progress main Pages deploy.
  group: pages-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      # Compute the short SHA of HEAD here so vite.config.ts can splice it
      # into the bundle (define: VITE_COMMIT_ID). Mirrors what the Go services
      # do via -ldflags so every frontend error reported to New Relic carries
      # the same build identifier the api/worker/provisioner logs use.
      - name: Export GIT_SHA
        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
      - run: npm run build
        env:
          VITE_API_URL: https://api.instanode.dev
          # New Relic browser-agent keys. Missing or empty → main.tsx skips
          # init (fail-open), so PR forks / unconfigured envs still build cleanly.
          VITE_NEWRELIC_LICENSE_KEY: ${{ secrets.VITE_NEWRELIC_LICENSE_KEY }}
          VITE_NEWRELIC_APP_ID: ${{ secrets.VITE_NEWRELIC_APP_ID }}
          # ──────────────────────────────────────────────────────────────
          # SCHEDULED-MAINTENANCE TOGGLE (src/components/MaintenanceNotice.tsx).
          #
          # '1' → the published Pages build renders the customer-facing
          #       maintenance banner (every route) + a one-time dismissible
          #       modal on /app* + /login*. This is ON because the prod
          #       cluster (api.instanode.dev) is intentionally paused, so the
          #       SPA loads but every API call fails — the banner explains the
          #       downtime is scheduled and the data is safe.
          #
          # Gated to PUBLISH events only (push to main / manual dispatch) so a
          # PR's `build` check produces a byte-identical, banner-OFF artifact —
          # it never publishes (the deploy job below is PR-gated) and runs no
          # tests, so this has zero effect on the required CI checks. The
          # separate build-and-test / playwright / coverage / lighthouse jobs
          # never set this var, so they build with the notice OFF.
          #
          # ▶ TO TURN THE BANNER OFF ON RESUME: set this to '0' (or delete the
          #   line) and re-run this deploy — or revert the PR that added it.
          #   The component renders null when the flag is unset/'0'.
          VITE_MAINTENANCE_MODE: ${{ github.event_name != 'pull_request' && '1' || '0' }}
      # NOTE: do NOT `cp dist/index.html dist/404.html` here. prerender.mjs
      # already writes dist/404.html as the bare SPA shell so every /app/*
      # bookmark / shared link / magic-link callback rehydrates the React
      # router. Copying the post-prerender index.html would clobber the SPA
      # shell with the homepage SSG HTML, breaking every /app/* path.
      # See instanode-web/scripts/prerender.mjs Step 4.7.
      - uses: actions/upload-pages-artifact@v5
        with:
          path: dist

  deploy:
    needs: build
    # Publish only on push to main / manual dispatch — never on a PR.
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - id: deployment
        uses: actions/deploy-pages@v5