deploy.yml

name: Deploy

# A tool's release workflow sends `repository_dispatch` (type `docs`) when it has published, so the
# site shows the new version's pages; the daily run catches a signal that was lost. A failed run
# publishes nothing, so the site stays as it was.
on:
  push:
    branches: [main]
  schedule:
    - cron: "17 5 * * *"
  repository_dispatch:
    types: [docs]
  workflow_dispatch:
    inputs:
      ref:
        description: "Build every tool from this branch instead of its release tag (main = a preview of the next release)"
        required: false
        default: ""

permissions:
  contents: read

concurrency:
  group: deploy
  cancel-in-progress: false

jobs:
  platform:
    uses: ./.github/workflows/windows-install.yml

  security:
    permissions:
      contents: read
      actions: read
      security-events: write
    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@08d954b245268c7552a2d33a9ed4c78743784e5a # v0.61.2

  build:
    needs: [platform, security]
    runs-on: ubuntu-latest
    env:
      REF: ${{ inputs.ref }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm sync ${REF:+--ref "$REF"}
      - run: pnpm test
      - run: pnpm docs:release-notes
        if: env.REF == ''
      - run: pnpm docs:contracts
      - run: |
          if [ -n "$REF" ]; then
            pnpm docs:lint
            pnpm docs:quality
          else
            pnpm docs:check
          fi
      - run: pnpm typecheck
      # The download page lists WireCat Desktop releases at build time; without a token GitHub allows 60 calls an hour.
      - run: pnpm exec next build
        env:
          GITHUB_TOKEN: ${{ github.token }}
      - run: pnpm check:assets
      - run: pnpm check:links
      - run: pnpm check:seo
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: site
          path: out
          if-no-files-found: error
          include-hidden-files: true
          retention-days: 1

  # The browser suite is most of a deploy's time; four machines run a quarter each against the one build.
  browser:
    needs: build
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: site
          path: out
      - run: pnpm exec playwright install --with-deps chromium
      - run: pnpm exec playwright test --shard=${{ matrix.shard }}/4
        env:
          PLAYWRIGHT_EXPORT: "1"
      - run: pnpm check:browser-timings
      - name: Save browser diagnostics
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: playwright-${{ matrix.shard }}-${{ github.run_attempt }}
          path: |
            playwright-report/results.json
            test-results/
          if-no-files-found: ignore
          retention-days: 7
          compression-level: 1

  deploy:
    needs: [build, browser]
    runs-on: ubuntu-latest
    # The token can replace what wirecat.dev serves (install.ps1 among it), so it lives in an
    # environment only main can deploy to, and only the step that uses it sees it.
    environment: production
    env:
      WRANGLER: pnpm dlx wrangler@4.146.0
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      # No install here, and a cache restored into the job holding the token is one more way in.
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          package-manager-cache: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: site
          path: out
      - name: Cloudflare Pages
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          if [ -z "$CLOUDFLARE_API_TOKEN" ]; then
            echo "::error::CLOUDFLARE_API_TOKEN is not set — built, not deployed"
            exit 1
          fi
          # The first deploy creates the project; later ones are told it exists, and the deploy below
          # fails on its own if anything else went wrong. The custom domain is attached once, in the
          # dashboard.
          $WRANGLER pages project create cli-docs --production-branch main || echo "cli-docs exists"
          $WRANGLER pages deploy out --project-name cli-docs --branch main