deploy.yml

name: "\U0001F680 Deploy"
on:
    push:
        branches:
            - main

concurrency:
    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
    cancel-in-progress: true

permissions:
    contents: read

jobs:
    # ─── Documentation ───────────────────────────────────────────────
    build-doc:
        name: "\U0001F528 Build (doc)"
        runs-on: ubuntu-latest
        timeout-minutes: 5

        steps:
            - name: "\U0001F4E5 Checkout repo"
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  persist-credentials: false

            # No cache — deploy builds must be hermetic
            - name: "⚙️ Setup node"
              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
              with:
                  node-version: 22

            - name: "\U0001F4E5 Download deps"
              run: make doc-install

            - name: "\U0001F528 Build Registry"
              run: make registry-build

            - name: "\U0001F528 Build Documentation"
              run: make doc-build

            - name: "\U0001F4E4 Upload doc artifacts"
              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
              with:
                  name: doc-artifacts
                  path: |
                      doc/dist
                      public/r

    deploy-doc:
        name: "\U0001F680 Deploy (doc)"
        runs-on: ubuntu-latest
        timeout-minutes: 5
        needs: build-doc
        permissions:
            contents: write
            pages: write

        steps:
            - name: "\U0001F4E5 Checkout repo"
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  persist-credentials: false

            - name: "⚙️ Setup git"
              run: |
                git remote set-url origin "https://git:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}"
                git config --global user.email support+actions@github.com
                git config --global user.name github-actions-bot
              env:
                GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

            - name: "\U0001F4E5 Download doc artifacts"
              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
              with:
                  name: doc-artifacts

            - name: "\U0001F4E1 Deploy Registry"
              run: cd public/r && npx gh-pages -b gh-pages -d ./ -s atomic-crm.json -e r -m "Deploy registry" --remove r

            - name: "\U0001F4E1 Deploy Documentation"
              run: cd doc && npx gh-pages -b gh-pages -d dist -e doc -m "Deploy docs" --remove doc

    # ─── Demo ────────────────────────────────────────────────────────
    build-demo:
        name: "\U0001F528 Build (demo)"
        runs-on: ubuntu-latest
        timeout-minutes: 10

        env:
            VITE_IS_DEMO: true
            VITE_INBOUND_EMAIL: ${{ vars.VITE_INBOUND_EMAIL }}

        steps:
            - name: "\U0001F4E5 Checkout repo"
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  persist-credentials: false

            # No cache — deploy builds must be hermetic
            - name: "⚙️ Setup node"
              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
              with:
                  node-version: 22

            - name: "\U0001F4E5 Download deps"
              run: npm ci

            - name: "\U0001F528 Build"
              run: npm run build:demo

            - name: "\U0001F4E4 Upload demo artifacts"
              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
              with:
                  name: demo-artifacts
                  path: dist

    deploy-demo:
        name: "\U0001F680 Deploy (demo)"
        if: ${{ vars.DEMO_DEPLOY_REPOSITORY != '' }}
        runs-on: ubuntu-latest
        timeout-minutes: 5
        needs: build-demo
        permissions:
            contents: write
            pages: write

        env:
            PRODUCTION_REMOTE: https://git:${{ secrets.DEPLOY_TOKEN || secrets.GITHUB_TOKEN }}@github.com/${{ vars.DEMO_DEPLOY_REPOSITORY }}

        steps:
            - name: "\U0001F4E5 Checkout repo"
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  persist-credentials: false

            - name: "⚙️ Setup node"
              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
              with:
                  node-version: 22

            - name: "⚙️ Setup git"
              run: |
                  echo "Deploying to pages to $DEMO_DEPLOY_REPOSITORY"
                  git remote set-url origin "https://git:${DEPLOY_TOKEN}@github.com/${DEMO_DEPLOY_REPOSITORY}"
                  git remote add production "$PRODUCTION_REMOTE"
                  git config --global user.email support+actions@github.com
                  git config --global user.name github-actions-bot
              env:
                  DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN || secrets.GITHUB_TOKEN }}
                  DEMO_DEPLOY_REPOSITORY: ${{ vars.DEMO_DEPLOY_REPOSITORY }}

            - name: "\U0001F4E5 Download demo artifacts"
              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
              with:
                  name: demo-artifacts
                  path: dist

            - name: "\U0001F4E1 Deploy GitHub pages"
              run: npx gh-pages --remote production -d dist -b "${DEPLOY_BRANCH:-gh-pages}"
              env:
                  GITHUB_TOKEN: ${{ secrets.DEPLOY_TOKEN || secrets.GITHUB_TOKEN }}
                  DEPLOY_BRANCH: ${{ vars.DEPLOY_BRANCH }}

    # ─── Supabase ────────────────────────────────────────────────────
    build-supabase:
        name: "\U0001F528 Build (supabase)"
        runs-on: ubuntu-latest
        timeout-minutes: 10

        env:
            # Vite embeds these at build time (client-side values only)
            VITE_SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
            VITE_SB_PUBLISHABLE_KEY: ${{ secrets.SB_PUBLISHABLE_KEY }}
            VITE_GOOGLE_WORKPLACE_DOMAIN: ${{ secrets.VITE_GOOGLE_WORKPLACE_DOMAIN }}
            VITE_IS_DEMO: ${{ vars.VITE_IS_DEMO }}
            VITE_INBOUND_EMAIL: ${{ vars.VITE_INBOUND_EMAIL }}

        steps:
            - name: "\U0001F4E5 Checkout repo"
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  persist-credentials: false

            # No cache — deploy builds must be hermetic
            - name: "⚙️ Setup node"
              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
              with:
                  node-version: 22

            - name: "\U0001F4E5 Download deps"
              run: npm ci

            - name: "\U0001F528 Build"
              run: npm run build

            - name: "\U0001F4E4 Upload supabase artifacts"
              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
              with:
                  name: supabase-artifacts
                  path: dist

    deploy-supabase:
        name: "\U0001F680 Deploy (supabase)"
        if: ${{ vars.DEPLOY_REPOSITORY != '' }}
        runs-on: ubuntu-latest
        timeout-minutes: 10
        needs: build-supabase
        permissions:
            contents: write
            pages: write

        env:
            SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
            SUPABASE_DB_PASSWORD: ${{ secrets.SUPABASE_DB_PASSWORD }}
            SUPABASE_PROJECT_ID: ${{ secrets.SUPABASE_PROJECT_ID }}
            VITE_SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
            VITE_SB_PUBLISHABLE_KEY: ${{ secrets.SB_PUBLISHABLE_KEY }}
            IS_SUPABASE_CONFIGURED: ${{ secrets.SUPABASE_ACCESS_TOKEN && secrets.SUPABASE_DB_PASSWORD && secrets.SUPABASE_PROJECT_ID && secrets.SUPABASE_URL && secrets.SB_PUBLISHABLE_KEY }}
            VITE_IS_DEMO: ${{ vars.VITE_IS_DEMO }}
            VITE_INBOUND_EMAIL: ${{ vars.VITE_INBOUND_EMAIL }}
            PRODUCTION_REMOTE: https://git:${{ secrets.DEPLOY_TOKEN || secrets.GITHUB_TOKEN }}@github.com/${{ vars.DEPLOY_REPOSITORY }}
            POSTMARK_WEBHOOK_USER: ${{ secrets.POSTMARK_WEBHOOK_USER }}
            POSTMARK_WEBHOOK_PASSWORD: ${{ secrets.POSTMARK_WEBHOOK_PASSWORD }}
            POSTMARK_WEBHOOK_AUTHORIZED_IPS: ${{ secrets.POSTMARK_WEBHOOK_AUTHORIZED_IPS }}
            VITE_GOOGLE_WORKPLACE_DOMAIN: ${{ secrets.VITE_GOOGLE_WORKPLACE_DOMAIN }}

        steps:
            - name: "\U0001F4E5 Checkout repo"
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  persist-credentials: false

            - name: "⚙️ Setup git"
              run: |
                  echo "Deploying to pages to $DEPLOY_REPOSITORY"
                  git remote set-url origin "https://git:${DEPLOY_TOKEN}@github.com/${DEPLOY_REPOSITORY}"
                  git remote add production "$PRODUCTION_REMOTE"
                  git config --global user.email support+actions@github.com
                  git config --global user.name github-actions-bot
              env:
                  DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN || secrets.GITHUB_TOKEN }}
                  DEPLOY_REPOSITORY: ${{ vars.DEPLOY_REPOSITORY }}

            - name: "⚙️ Setup supabase"
              uses: supabase/setup-cli@b60b5899c73b63a2d2d651b1e90db8d4c9392f51 # v1.6.0

            - name: "\U0001F4E5 Download supabase artifacts"
              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
              with:
                  name: supabase-artifacts
                  path: dist

            - if: ${{ env.IS_SUPABASE_CONFIGURED }}
              name: "\U0001F517 Supabase Link"
              run: npx supabase link --project-ref $SUPABASE_PROJECT_ID

            - if: ${{ env.IS_SUPABASE_CONFIGURED }}
              name: "\U0001F4E1 Push supabase migrations"
              run: npx supabase db push

            - if: ${{ env.IS_SUPABASE_CONFIGURED && env.POSTMARK_WEBHOOK_USER && env.POSTMARK_WEBHOOK_PASSWORD && env.POSTMARK_WEBHOOK_AUTHORIZED_IPS }}
              name: "\U0001F4E1 Push supabase postmark webhook user secret"
              run: |
                  npx supabase secrets set "POSTMARK_WEBHOOK_USER=$POSTMARK_WEBHOOK_USER"
                  npx supabase secrets set "POSTMARK_WEBHOOK_PASSWORD=$POSTMARK_WEBHOOK_PASSWORD"
                  npx supabase secrets set "POSTMARK_WEBHOOK_AUTHORIZED_IPS=$POSTMARK_WEBHOOK_AUTHORIZED_IPS"
                  npx supabase secrets set "VITE_INBOUND_EMAIL=$VITE_INBOUND_EMAIL"

            - if: ${{ env.IS_SUPABASE_CONFIGURED }}
              name: "\U0001F4E1 Deploy supabase functions"
              run: npx supabase functions deploy

            - if: ${{ !env.SUPABASE_ACCESS_TOKEN }}
              name: Check SUPABASE_ACCESS_TOKEN secret
              run: echo ':warning:SUPABASE_ACCESS_TOKEN secret is missing' >> $GITHUB_STEP_SUMMARY

            - if: ${{ !env.SUPABASE_DB_PASSWORD }}
              name: Check SUPABASE_DB_PASSWORD secret
              run: echo ':warning:SUPABASE_DB_PASSWORD secret is missing' >> $GITHUB_STEP_SUMMARY

            - if: ${{ !env.SUPABASE_PROJECT_ID }}
              name: Check SUPABASE_PROJECT_ID secret
              run: echo ':warning:SUPABASE_PROJECT_ID secret is missing' >> $GITHUB_STEP_SUMMARY

            - if: ${{ !env.VITE_SUPABASE_URL }}
              name: Check SUPABASE_URL secret
              run: echo ':warning:SUPABASE_URL secret is missing' >> $GITHUB_STEP_SUMMARY

            - if: ${{ !env.VITE_SB_PUBLISHABLE_KEY }}
              name: Check SB_PUBLISHABLE_KEY secret
              run: echo ':warning:SB_PUBLISHABLE_KEY secret is missing' >> $GITHUB_STEP_SUMMARY

            - if: ${{ !env.POSTMARK_WEBHOOK_USER }}
              name: Check POSTMARK_WEBHOOK_USER secret
              run: echo ':warning:POSTMARK_WEBHOOK_USER secret is missing' >> $GITHUB_STEP_SUMMARY

            - if: ${{ !env.POSTMARK_WEBHOOK_PASSWORD }}
              name: Check POSTMARK_WEBHOOK_PASSWORD secret
              run: echo ':warning:POSTMARK_WEBHOOK_PASSWORD secret is missing' >> $GITHUB_STEP_SUMMARY

            - if: ${{ !env.POSTMARK_WEBHOOK_AUTHORIZED_IPS }}
              name: Check POSTMARK_WEBHOOK_AUTHORIZED_IPS secret
              run: echo ':warning:POSTMARK_WEBHOOK_AUTHORIZED_IPS secret is missing' >> $GITHUB_STEP_SUMMARY

            - if: ${{ !env.IS_SUPABASE_CONFIGURED }}
              name: Supabase deployment skipped
              run: echo ':warning:Supabase deployment skipped' >> $GITHUB_STEP_SUMMARY

            - name: "\U0001F4E1 Deploy GitHub pages"
              run: npx gh-pages --remote production -d dist -b "${DEPLOY_BRANCH:-gh-pages}"
              env:
                  GITHUB_TOKEN: ${{ secrets.DEPLOY_TOKEN || secrets.GITHUB_TOKEN }}
                  DEPLOY_BRANCH: ${{ vars.DEPLOY_BRANCH }}