deploy.yml

name: Deploy

on:
  push:
    branches:
      - main
    paths:
      - 'apps/marketing/**'
      - 'apps/portal/**'
      - 'apps/paste-service/**'
      - 'apps/waitlist-service/**'
      - 'packages/**'
  workflow_dispatch:
    inputs:
      target:
        description: 'Deploy target'
        required: true
        default: 'all'
        type: choice
        options:
          - all
          - marketing
          - portal
          - paste
          - waitlist

permissions:
  contents: read

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      marketing: ${{ steps.changes.outputs.marketing }}
      portal: ${{ steps.changes.outputs.portal }}
      paste: ${{ steps.changes.outputs.paste }}
      waitlist: ${{ steps.changes.outputs.waitlist }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check for changes
        id: changes
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            if [[ "${{ inputs.target }}" == "all" || "${{ inputs.target }}" == "marketing" ]]; then
              echo "marketing=true" >> $GITHUB_OUTPUT
            else
              echo "marketing=false" >> $GITHUB_OUTPUT
            fi
            if [[ "${{ inputs.target }}" == "all" || "${{ inputs.target }}" == "portal" ]]; then
              echo "portal=true" >> $GITHUB_OUTPUT
            else
              echo "portal=false" >> $GITHUB_OUTPUT
            fi
            if [[ "${{ inputs.target }}" == "all" || "${{ inputs.target }}" == "paste" ]]; then
              echo "paste=true" >> $GITHUB_OUTPUT
            else
              echo "paste=false" >> $GITHUB_OUTPUT
            fi
            if [[ "${{ inputs.target }}" == "all" || "${{ inputs.target }}" == "waitlist" ]]; then
              echo "waitlist=true" >> $GITHUB_OUTPUT
            else
              echo "waitlist=false" >> $GITHUB_OUTPUT
            fi
          else
            # For push events, check what changed
            git fetch origin ${{ github.event.before }} --depth=1 2>/dev/null || true

            MARKETING_CHANGED=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }} 2>/dev/null | grep -E '^(apps/marketing/|packages/)' || true)
            PORTAL_CHANGED=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }} 2>/dev/null | grep -E '^(apps/portal/|packages/)' || true)
            PASTE_CHANGED=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }} 2>/dev/null | grep -E '^apps/paste-service/' || true)
            WAITLIST_CHANGED=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }} 2>/dev/null | grep -E '^apps/waitlist-service/' || true)

            if [[ -n "$MARKETING_CHANGED" ]]; then
              echo "marketing=true" >> $GITHUB_OUTPUT
            else
              echo "marketing=false" >> $GITHUB_OUTPUT
            fi

            if [[ -n "$PORTAL_CHANGED" ]]; then
              echo "portal=true" >> $GITHUB_OUTPUT
            else
              echo "portal=false" >> $GITHUB_OUTPUT
            fi

            if [[ -n "$PASTE_CHANGED" ]]; then
              echo "paste=true" >> $GITHUB_OUTPUT
            else
              echo "paste=false" >> $GITHUB_OUTPUT
            fi

            if [[ -n "$WAITLIST_CHANGED" ]]; then
              echo "waitlist=true" >> $GITHUB_OUTPUT
            else
              echo "waitlist=false" >> $GITHUB_OUTPUT
            fi
          fi

  deploy-marketing:
    needs: detect-changes
    if: needs.detect-changes.outputs.marketing == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    environment: production
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Build marketing
        run: bun run build:marketing
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1

      - name: Deploy to S3
        run: aws s3 sync apps/marketing/dist/ s3://plannotator-marketing/ --delete

      - name: Invalidate CloudFront
        run: |
          aws cloudfront create-invalidation \
            --distribution-id E284ON0A27O2H6 \
            --paths "/*"

  deploy-portal:
    needs: detect-changes
    if: needs.detect-changes.outputs.portal == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    environment: production
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Build portal
        run: bun run build:portal

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1

      - name: Deploy to S3
        run: aws s3 sync apps/portal/dist/ s3://plannotator-portal/ --delete

      - name: Invalidate CloudFront
        run: |
          aws cloudfront create-invalidation \
            --distribution-id EP0KB9EFUWYXR \
            --paths "/*"

  deploy-paste:
    needs: detect-changes
    if: needs.detect-changes.outputs.paste == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    environment: production
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Deploy to Cloudflare
        working-directory: apps/paste-service
        run: npx wrangler deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

  deploy-waitlist:
    needs: detect-changes
    if: needs.detect-changes.outputs.waitlist == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    environment: production
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Deploy to Cloudflare
        working-directory: apps/waitlist-service
        run: npx wrangler deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}