deploy.yml

name: Deploy Documentation

# Matching 0xNAND's release boundary: merging code never deploys remotely.
# Releases require an explicit dispatch from main, exact confirmation,
# environment-specific readiness and GitHub Environment protection.
on:
  workflow_dispatch:
    inputs:
      target:
        description: "Deployment target"
        required: true
        type: choice
        options:
          - staging
          - production
      confirmation:
        description: "Type DEPLOY_STAGING or DEPLOY_PRODUCTION"
        required: true
        type: string

concurrency:
  group: documentation-release-${{ inputs.target }}
  cancel-in-progress: false

permissions:
  contents: read
  packages: read

jobs:
  authorize-release:
    name: Verify explicit release request
    runs-on: ubuntu-latest
    steps:
      - name: Require main and exact confirmation
        env:
          SOURCE_REF: ${{ github.ref }}
          TARGET: ${{ inputs.target }}
          CONFIRMATION: ${{ inputs.confirmation }}
        shell: bash
        run: |
          if [[ "$SOURCE_REF" != "refs/heads/main" ]]; then
            echo "::error::Documentation releases must be dispatched from main."
            exit 1
          fi
          case "$TARGET" in
            staging) expected="DEPLOY_STAGING" ;;
            production) expected="DEPLOY_PRODUCTION" ;;
            *) echo "::error::Invalid target."; exit 1 ;;
          esac
          if [[ "$CONFIRMATION" != "$expected" ]]; then
            echo "::error::Release confirmation does not match the target."
            exit 1
          fi

  deploy:
    name: Deploy Documentation
    needs:
      - authorize-release
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment:
      name: ${{ inputs.target }}

    steps:
      - name: Require verified environment readiness
        env:
          RELEASE_READY: ${{ vars.DOCS_RELEASE_READY }}
        shell: bash
        run: |
          if [[ "$RELEASE_READY" != "true" ]]; then
            echo "::error::Documentation release blocked. Verify Cloudflare R2, domain, secrets and manifests, then set DOCS_RELEASE_READY=true in this GitHub Environment."
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 11.2.2

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm

      - name: Install with private package read permission
        run: pnpm install --frozen-lockfile
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Typecheck
        run: pnpm typecheck

      - name: Tests
        run: pnpm test

      - name: Build selected Cloudflare environment
        env:
          TARGET: ${{ inputs.target }}
        shell: bash
        run: |
          if [[ "$TARGET" == "staging" ]]; then
            pnpm build:staging
          else
            pnpm build
          fi
          node scripts/check-deploy-config.mjs "$TARGET"

      - name: Report client bundle sizes
        run: pnpm bundle:report

      # @cloudflare/vite-plugin already wrote the selected flattened config.
      # Do not pass --env to wrangler deploy.
      - name: Deploy to Cloudflare
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: pnpm exec wrangler deploy

      - name: Smoke-test deployed environment
        env:
          TARGET: ${{ inputs.target }}
        shell: bash
        run: |
          case "$TARGET" in
            staging) URL="https://staging.docs.0xbuff.com" ;;
            production) URL="https://docs.0xbuff.com" ;;
            *) echo "::error::Invalid smoke-test target"; exit 1 ;;
          esac

          curl --fail --silent --show-error "$URL/" >/dev/null
          curl --fail --silent --show-error --location "$URL/docs" >/dev/null
          curl --fail --silent --show-error "$URL/llms.txt" >/dev/null
          curl --fail --silent --show-error "$URL/llms-full.txt" >/dev/null
          curl --fail --silent --show-error "$URL/robots.txt" >/dev/null
          curl --fail --silent --show-error "$URL/sitemap.xml" >/dev/null
          curl --fail --silent --show-error "$URL/search-index.json" >/dev/null

          # An invalid email must not create a Resend contact.
          status="$(curl --silent --output /dev/null --write-out '%{http_code}' \
            -X POST "$URL/subscribe" --data-urlencode "email=invalid")"
          case "$status" in
            400|503) echo "Newsletter invalid-input probe: $status" ;;
            *) echo "::error::Unexpected newsletter status $status"; exit 1 ;;
          esac