deploy.yml

name: Deploy

on:
  workflow_dispatch:
    inputs:
      environment:
        description: Target Cloudflare environment
        required: true
        type: choice
        options:
          - dev
          - staging
          - production
      run_seed:
        description: Run demo seed after migration
        required: true
        default: false
        type: boolean

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: TypeScript check
        run: npm run check

      - name: Environment config check
        run: SKIP_LOCAL_SECRET_CHECKS=true bash ./scripts/check_config.sh "${{ inputs.environment }}"

      - name: Apply D1 migration
        run: npm run "d1:migrate:remote:${{ inputs.environment }}"
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      - name: Optionally seed D1
        if: ${{ inputs.run_seed }}
        run: npm run "d1:seed:remote:${{ inputs.environment }}"
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      - name: Deploy Worker
        run: npm run "deploy:${{ inputs.environment }}"
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      - name: Verify production read-only surface
        if: ${{ inputs.environment == 'production' }}
        run: npm run verify:production:readonly