deploy.yml

name: Deploy

on:
  workflow_dispatch:
  push:
    branches: [main]

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      # Skip (green) until Cloudflare credentials are configured in repo secrets,
      # so pushes don't fail before the project is provisioned.
      - name: Check Cloudflare token
        id: cf
        env:
          CF_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: |
          if [ -z "$CF_TOKEN" ]; then
            echo "ready=false" >> "$GITHUB_OUTPUT"
            echo "::notice::CLOUDFLARE_API_TOKEN not set — skipping deploy. Add CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID in Settings → Secrets to enable."
          else
            echo "ready=true" >> "$GITHUB_OUTPUT"
          fi

      - if: steps.cf.outputs.ready == 'true'
        uses: actions/checkout@v4
      - if: steps.cf.outputs.ready == 'true'
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - if: steps.cf.outputs.ready == 'true'
        run: npm ci
      - if: steps.cf.outputs.ready == 'true'
        run: npm run cf-typegen
      - if: steps.cf.outputs.ready == 'true'
        run: npm run typecheck
      - if: steps.cf.outputs.ready == 'true'
        run: npm run build

      # DB migrations are NOT run here — if the Postgres firewall is locked to
      # Cloudflare IP ranges, CI runners can't reach it. Run `npm run db:migrate`
      # from an allowed machine when the schema changes, then push.

      - name: Deploy to Cloudflare Workers
        if: steps.cf.outputs.ready == 'true'
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: deploy -c dist/shortlink/wrangler.json