pages-deploy.yml

# SPDX-License-Identifier: MPL-2.0
# Cloudflare Pages deploy via Direct Upload (wrangler pages deploy).
# Bypasses the Cloudflare build system entirely — no .tool-versions install
# attempt, no `wrangler deploy` (Workers command) confusion.
# Required secrets: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID
name: Deploy to Cloudflare Pages

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Deploy site/ to Cloudflare Pages
        # Self-gate in the shell, not in an `if:`. Gating a job/step `if:` on
        # `secrets.*` is the estate compile-error anti-pattern — secrets are
        # not available in `if:` expression context. Hoisting the secret into
        # `env:` and testing it in bash is the supported way to degrade to a
        # green no-op when the deployment is not configured, and it is the
        # same shape boj-build.yml uses to self-gate on BOJ_URL.
        run: |
          set -euo pipefail
          if [ -z "${CLOUDFLARE_API_TOKEN:-}" ] || [ -z "${CLOUDFLARE_ACCOUNT_ID:-}" ]; then
            echo "Cloudflare Pages deployment is not configured for this repository."
            echo "Set the CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID secrets to enable it."
            echo "Skipping (not a failure)."
            exit 0
          fi
          npx wrangler@latest pages deploy site/ --project-name=boj-server-cartridges
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}