deploy-docs.yml

name: Deploy Documentation

on:
  push:
    branches:
      - main
    paths:
      - 'README.md'                               # Monorepo root
      - 'CONTRIBUTING.md'                         # Monorepo root
      - 'LICENSE'                                 # Monorepo root
      - 'extensions/git-id-switcher/**/*.md'      # All .md files (auto-detected)
      - 'extensions/git-id-switcher/LICENSE'      # Extension LICENSE
  workflow_dispatch:  # Manual trigger

permissions: {}

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read  # Read-only: CDN deploy only (Option D)
    # Prevent forks from deploying (no Cloudflare secrets)
    if: github.repository == 'nullvariant/nullvariant-vscode-extensions'

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      # Note: Hash update is handled by developers locally + hash-check.yml in PRs
      # This workflow only deploys to CDN (Option D: Pre-merge CI verification)

      - name: Deploy documentation to R2
        run: |
          R2_BASE="kura/nullvariant.com/nullvariant-vscode-extensions"
          EXT_PATH="extensions/git-id-switcher"

          # === Monorepo root files ===
          echo "=== Deploying monorepo root files ==="

          if [ -f "README.md" ]; then
            echo "Deploying monorepo README.md..."
            npx wrangler@4.54.0 r2 object put "${R2_BASE}/README.md" \
              --file "README.md" \
              --content-type "text/markdown; charset=utf-8" \
              --remote
          fi

          if [ -f "CONTRIBUTING.md" ]; then
            echo "Deploying monorepo CONTRIBUTING.md..."
            npx wrangler@4.54.0 r2 object put "${R2_BASE}/CONTRIBUTING.md" \
              --file "CONTRIBUTING.md" \
              --content-type "text/markdown; charset=utf-8" \
              --remote
          fi

          if [ -f "LICENSE" ]; then
            echo "Deploying monorepo LICENSE..."
            npx wrangler@4.54.0 r2 object put "${R2_BASE}/LICENSE" \
              --file "LICENSE" \
              --content-type "text/plain; charset=utf-8" \
              --remote
          fi

          # === Extension files (all .md + LICENSE) ===
          echo "=== Deploying all extension .md files ==="

          # Deploy all .md files in extension directory (recursive)
          find "${EXT_PATH}" -name "*.md" -type f \
            ! -path "${EXT_PATH}/node_modules/*" \
            ! -path "${EXT_PATH}/out/*" \
            ! -path "${EXT_PATH}/.vscode-test/*" | while read -r doc_file; do
            relative_path="${doc_file#${EXT_PATH}/}"
            echo "Deploying ${relative_path}..."
            npx wrangler@4.54.0 r2 object put "${R2_BASE}/${EXT_PATH}/${relative_path}" \
              --file "$doc_file" \
              --content-type "text/markdown; charset=utf-8" \
              --remote
          done

          # Deploy extension LICENSE
          if [ -f "${EXT_PATH}/LICENSE" ]; then
            echo "Deploying extension LICENSE..."
            npx wrangler@4.54.0 r2 object put "${R2_BASE}/${EXT_PATH}/LICENSE" \
              --file "${EXT_PATH}/LICENSE" \
              --content-type "text/plain; charset=utf-8" \
              --remote
          fi

          echo "=== Documentation deployed successfully! ==="
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}