deploy-reader.yml

name: Deploy Reader

# Lab deploys from CI on every push to main. Staging and production are explicit.
on:
  workflow_dispatch:
    inputs:
      target:
        description: Deployment target
        required: true
        type: choice
        options:
          - staging
          - production

permissions:
  contents: read

jobs:
  ci:
    uses: ./.github/workflows/ci.yml

  deploy:
    name: Deploy Reader to ${{ inputs.target }}
    needs: ci
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    concurrency:
      group: deploy-reader-${{ inputs.target }}
      cancel-in-progress: false
    environment:
      name: reader-${{ inputs.target }}
      url: ${{ inputs.target == 'production' && 'https://reader.mdbase.dev/' || 'https://staging.mdbase-reader.pages.dev/' }}
    env:
      MDBASE_ENV: ${{ inputs.target }}
    steps:
      - name: Require main
        if: github.ref != 'refs/heads/main'
        run: |
          echo "::error::Staging and production deploy only from main (got ${GITHUB_REF})."
          exit 1
      - name: Require Cloudflare credentials
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          if [ -z "$CLOUDFLARE_API_TOKEN" ] || [ -z "$CLOUDFLARE_ACCOUNT_ID" ]; then
            echo "::error::The reader-${MDBASE_ENV} environment needs CLOUDFLARE_API_TOKEN (Cloudflare Pages: Edit) and CLOUDFLARE_ACCOUNT_ID secrets."
            exit 1
          fi
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      # deploy-pages.mjs refuses a dirty tree for staging and production.
      - run: pnpm ${{ inputs.target == 'production' && 'deploy:prod' || 'deploy:dev' }}
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          VITE_MDBASE_FEEDBACK_URL: ${{ vars.MDBASE_FEEDBACK_URL }}
          VITE_MDBASE_FEEDBACK_TURNSTILE_SITE_KEY: ${{ vars.MDBASE_FEEDBACK_TURNSTILE_SITE_KEY }}
      - name: Verify deployed manifest
        env:
          ORIGIN: ${{ inputs.target == 'production' && 'https://reader.mdbase.dev' || 'https://staging.mdbase-reader.pages.dev' }}
        run: |
          for attempt in 1 2 3 4 5 6 7 8 9 10 11 12; do
            homepage=$(curl -fsS "$ORIGIN/.well-known/mdbase-app.json" | jq -r .homepage || true)
            if [ "$homepage" = "$ORIGIN/" ]; then
              echo "Manifest at $ORIGIN declares $homepage"
              exit 0
            fi
            sleep 5
          done
          echo "::error::$ORIGIN/.well-known/mdbase-app.json does not declare $ORIGIN/"
          exit 1