ADE/.github/workflows/deploy-web.yml at main · arul28/ADE · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: Deploy Web Surfaces

# Merged = deployed for the web tier. The desktop/iOS release workflow never
# touches these five surfaces (hosted web client on Cloudflare Pages + four
# Workers), which let production drift silently in the past. Push-to-main
# deploys exactly the surfaces whose code changed; workflow_dispatch deploys
# everything (manual full reconcile). Secrets are never exposed to fork PRs
# because this only runs on push to main and manual dispatch.

on:
  push:
    branches: [main]
    paths:
      - "apps/desktop/src/renderer/**"
      - "apps/desktop/src/shared/**"
      - "apps/desktop/vite.webclient.config.ts"
      - "apps/account-directory/**"
      - "apps/webhook-relay/**"
      - "apps/tunnel-relay/**"
      - "apps/push-relay/**"
      - ".github/workflows/deploy-web.yml"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: deploy-web
  cancel-in-progress: false

env:
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
  CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      webclient: ${{ steps.filter.outputs.webclient }}
      account-directory: ${{ steps.filter.outputs.account-directory }}
      webhook-relay: ${{ steps.filter.outputs.webhook-relay }}
      tunnel-relay: ${{ steps.filter.outputs.tunnel-relay }}
      push-relay: ${{ steps.filter.outputs.push-relay }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            webclient:
              - "apps/desktop/src/renderer/**"
              - "apps/desktop/src/shared/**"
              - "apps/desktop/vite.webclient.config.ts"
            account-directory:
              - "apps/account-directory/**"
            webhook-relay:
              - "apps/webhook-relay/**"
            tunnel-relay:
              - "apps/tunnel-relay/**"
            push-relay:
              - "apps/push-relay/**"

  webclient:
    needs: changes
    if: needs.changes.outputs.webclient == 'true' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Install desktop dependencies
        run: cd apps/desktop && npm ci
      - name: Build web client
        run: cd apps/desktop && npm run build:webclient
      - name: Deploy to Cloudflare Pages
        run: npx wrangler@4 pages deploy apps/desktop/dist/web-client --project-name ade-web-client --branch main --commit-hash "$GITHUB_SHA"
      - name: Verify live bundle
        run: |
          built="$(basename apps/desktop/dist/web-client/assets/index-*.js)"
          for i in 1 2 3 4 5 6; do
            live="$(curl -fsS https://app.ade-app.dev | grep -oE 'index-[A-Za-z0-9_-]+\.js' | head -1 || true)"
            [ "$built" = "$live" ] && { echo "verified: $live"; exit 0; }
            echo "waiting for propagation ($i): built=$built live=$live"; sleep 20
          done
          echo "::error::deployed bundle did not propagate (built=$built live=$live)"; exit 1

  account-directory:
    needs: changes
    if: needs.changes.outputs.account-directory == 'true' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: cd apps/account-directory && npm ci
      - name: Deploy production Worker
        run: cd apps/account-directory && npx wrangler deploy --env production
      - name: Verify health
        run: curl -fsS https://ade-account-directory-production.arulsharma1028.workers.dev/health | grep -q '"ok":true'

  webhook-relay:
    needs: changes
    if: needs.changes.outputs.webhook-relay == 'true' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: cd apps/webhook-relay && npm ci
      - name: Deploy Worker
        run: cd apps/webhook-relay && npx wrangler deploy

  tunnel-relay:
    needs: changes
    if: needs.changes.outputs.tunnel-relay == 'true' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: cd apps/tunnel-relay && npm ci
      - name: Deploy Worker
        run: cd apps/tunnel-relay && npx wrangler deploy

  push-relay:
    needs: changes
    if: needs.changes.outputs.push-relay == 'true' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: cd apps/push-relay && npm ci
      - name: Deploy Worker
        run: cd apps/push-relay && npx wrangler deploy