name: Deploy EdgeEver

on:
  push:
    branches:
      - main
    paths-ignore:
      - "apps/site/**"
      - ".github/workflows/deploy-site.yml"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: edgeever-production
  cancel-in-progress: false

jobs:
  deploy:
    name: Deploy Cloudflare Workers
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      EDGE_EVER_TIANMA_WORKER_NAME: ${{ secrets.EDGE_EVER_TIANMA_WORKER_NAME }}
      EDGE_EVER_TIANMA_CUSTOM_DOMAIN: ${{ secrets.EDGE_EVER_TIANMA_CUSTOM_DOMAIN }}
      EDGE_EVER_TIANMA_D1_DATABASE_NAME: ${{ secrets.EDGE_EVER_TIANMA_D1_DATABASE_NAME }}
      EDGE_EVER_TIANMA_D1_DATABASE_ID: ${{ secrets.EDGE_EVER_TIANMA_D1_DATABASE_ID }}
      EDGE_EVER_TIANMA_R2_BUCKET_NAME: ${{ secrets.EDGE_EVER_TIANMA_R2_BUCKET_NAME }}
      EDGE_EVER_TIANMA_R2_PREVIEW_BUCKET_NAME: ${{ secrets.EDGE_EVER_TIANMA_R2_PREVIEW_BUCKET_NAME }}
      EDGE_EVER_TIANMA_AUTH_USERNAME: ${{ secrets.EDGE_EVER_TIANMA_AUTH_USERNAME }}
      EDGE_EVER_TIANMA_AUTH_PASSWORD_HASH: ${{ secrets.EDGE_EVER_TIANMA_AUTH_PASSWORD_HASH }}
      EDGE_EVER_TIANMA_SESSION_TTL_DAYS: ${{ secrets.EDGE_EVER_TIANMA_SESSION_TTL_DAYS }}
      EDGE_EVER_DEMO_WORKER_NAME: ${{ secrets.EDGE_EVER_DEMO_WORKER_NAME }}
      EDGE_EVER_DEMO_ROUTE_PATTERN: ${{ secrets.EDGE_EVER_DEMO_ROUTE_PATTERN }}
      EDGE_EVER_DEMO_D1_DATABASE_NAME: ${{ secrets.EDGE_EVER_DEMO_D1_DATABASE_NAME }}
      EDGE_EVER_DEMO_D1_DATABASE_ID: ${{ secrets.EDGE_EVER_DEMO_D1_DATABASE_ID }}
      EDGE_EVER_DEMO_R2_BUCKET_NAME: ${{ secrets.EDGE_EVER_DEMO_R2_BUCKET_NAME }}
      EDGE_EVER_DEMO_R2_PREVIEW_BUCKET_NAME: ${{ secrets.EDGE_EVER_DEMO_R2_PREVIEW_BUCKET_NAME }}
      EDGE_EVER_DEMO_AUTH_USERNAME: ${{ secrets.EDGE_EVER_DEMO_AUTH_USERNAME }}
      EDGE_EVER_DEMO_AUTH_PASSWORD_HASH: ${{ secrets.EDGE_EVER_DEMO_AUTH_PASSWORD_HASH }}
      EDGE_EVER_DEMO_SESSION_TTL_DAYS: ${{ secrets.EDGE_EVER_DEMO_SESSION_TTL_DAYS }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Typecheck
        run: bun run typecheck

      - name: Deploy tianma instance
        run: EDGE_EVER_INSTANCE=tianma bun run deploy

      - name: Sync tianma auth secret
        run: |
          printf '%s' "$EDGE_EVER_TIANMA_AUTH_PASSWORD_HASH" \
            | EDGE_EVER_INSTANCE=tianma bun scripts/run-wrangler.mjs secret put EDGE_EVER_AUTH_PASSWORD_HASH

      - name: Deploy demo instance
        run: EDGE_EVER_INSTANCE=demo bun run deploy

      - name: Sync demo auth secret
        run: |
          printf '%s' "$EDGE_EVER_DEMO_AUTH_PASSWORD_HASH" \
            | EDGE_EVER_INSTANCE=demo bun scripts/run-wrangler.mjs secret put EDGE_EVER_AUTH_PASSWORD_HASH