zpan/.github/workflows/deploy-cloudflare.yml

name: Deploy to Cloudflare Workers

# Triggered by the top-level Deploy dispatcher (.github/workflows/deploy.yml)
# when CF secrets are configured. Manual runs via the Actions UI also
# supported.
on:
  workflow_call:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release tag to deploy (e.g. v2.1.0). Leave empty for latest.'
        required: false

# Prevent overlapping deployments.
concurrency:
  group: deploy-cloudflare
  cancel-in-progress: false

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    steps:
      - name: Disable upstream-only workflows
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          for workflow in ci.yml release.yml; do
            gh api -X PUT "repos/${{ github.repository }}/actions/workflows/$workflow/disable" 2>/dev/null && \
              echo "Disabled $workflow" || echo "$workflow already disabled"
          done

      - name: Check required secrets
        env:
          HAS_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN != '' }}
          HAS_ACCOUNT: ${{ secrets.CLOUDFLARE_ACCOUNT_ID != '' }}
        run: |
          if [ "$HAS_TOKEN" != "true" ] || [ "$HAS_ACCOUNT" != "true" ]; then
            echo "::error::Missing required secrets. Go to Settings → Secrets and variables → Actions and add CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID."
            exit 1
          fi

      - name: Resolve release tag
        id: release
        env:
          GH_TOKEN: ${{ github.token }}
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          if [ -n "$INPUT_VERSION" ]; then
            TAG="$INPUT_VERSION"
          else
            TAG=$(gh api repos/saltbo/zpan/releases/latest --jq '.tag_name')
          fi
          if [ -z "$TAG" ]; then
            echo "::error::No release found in saltbo/zpan"
            exit 1
          fi
          echo "version=$TAG" >> "$GITHUB_OUTPUT"
          echo "### 🚀 Deploying $TAG" >> "$GITHUB_STEP_SUMMARY"

      - uses: actions/checkout@v6
        with:
          repository: saltbo/zpan
          ref: ${{ steps.release.outputs.version }}

      - uses: actions/setup-node@v6
        with:
          node-version: 24

      - run: npm ci

      - name: Ensure D1 database exists
        id: d1
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          DB_ID=$(npx wrangler d1 list --json | jq -r '.[] | select(.name == "zpan-db") | .uuid')
          if [ -z "$DB_ID" ]; then
            # wrangler d1 create does not support --json; parse the TOML snippet it prints.
            DB_ID=$(npx wrangler d1 create zpan-db | awk -F'"' '/database_id/{print $2; exit}')
            echo "Created D1 database: $DB_ID"
          else
            echo "Reusing D1 database: $DB_ID"
          fi
          if [ -z "$DB_ID" ]; then
            echo "::error::Failed to obtain D1 database UUID"
            exit 1
          fi
          echo "id=$DB_ID" >> "$GITHUB_OUTPUT"

      - name: Ensure R2 public-images bucket exists
        env:
          CF_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CF_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          # Use CF REST API — `wrangler r2 bucket list` has no --json flag.
          EXISTS=$(curl -sf \
            "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT_ID/r2/buckets" \
            -H "Authorization: Bearer $CF_API_TOKEN" \
            | jq -r '.result.buckets[]? | select(.name == "zpan-public-images") | .name')
          if [ -z "$EXISTS" ]; then
            curl -sf -X POST \
              "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT_ID/r2/buckets" \
              -H "Authorization: Bearer $CF_API_TOKEN" \
              -H "Content-Type: application/json" \
              -d '{"name": "zpan-public-images"}' > /dev/null
            echo "Created R2 bucket: zpan-public-images"
          else
            echo "Reusing R2 bucket: zpan-public-images"
          fi

      - name: Enable R2 managed public URL + capture
        id: r2
        env:
          CF_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CF_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          # Idempotent: PUT enabled=true — CF returns the same pub-<hash>.r2.dev
          # on every call once enabled.
          curl -sf -X PUT \
            "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT_ID/r2/buckets/zpan-public-images/domains/managed" \
            -H "Authorization: Bearer $CF_API_TOKEN" \
            -H "Content-Type: application/json" \
            -d '{"enabled": true}' > /dev/null

          DOMAIN=$(curl -sf \
            "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT_ID/r2/buckets/zpan-public-images/domains/managed" \
            -H "Authorization: Bearer $CF_API_TOKEN" | jq -r '.result.domain')

          if [ -z "$DOMAIN" ] || [ "$DOMAIN" = "null" ]; then
            echo "::error::Failed to retrieve R2 managed public domain. Make sure CLOUDFLARE_API_TOKEN has 'R2 Storage: Edit' scope."
            exit 1
          fi
          echo "url=https://$DOMAIN" >> "$GITHUB_OUTPUT"
          echo "R2 public URL: https://$DOMAIN"

      - name: Patch wrangler.toml with D1 database ID
        run: sed -i "s/database_id = \"[^\"]*\"/database_id = \"${{ steps.d1.outputs.id }}\"/" wrangler.toml

      - name: Apply D1 migrations
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: npx wrangler d1 migrations apply DB --remote

      - name: Build
        run: npx vite build

      - name: Deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        # Run wrangler from the repo root so it uses the @cloudflare/vite-plugin's
        # redirect config (.wrangler/deploy/config.json) which points at the
        # built Worker (dist/zpan/wrangler.json). Cd'ing into dist/zpan instead
        # causes wrangler 4.x to error on conflicting base paths between the
        # two configs.
        run: npx wrangler deploy

      - name: Set BETTER_AUTH_SECRET (first deploy only)
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          USER_SECRET: ${{ secrets.BETTER_AUTH_SECRET }}
        run: |
          EXISTS=$(npx wrangler secret list --format json | jq -r '.[] | select(.name == "BETTER_AUTH_SECRET") | .name')
          if [ -n "$USER_SECRET" ]; then
            echo "$USER_SECRET" | npx wrangler secret put BETTER_AUTH_SECRET
            echo "Set BETTER_AUTH_SECRET from GitHub secret"
          elif [ -z "$EXISTS" ]; then
            openssl rand -base64 32 | npx wrangler secret put BETTER_AUTH_SECRET
            echo "Auto-generated BETTER_AUTH_SECRET"
          else
            echo "BETTER_AUTH_SECRET already set, skipping"
          fi

      - name: Set PUBLIC_IMAGES_URL (always upsert — R2 domain is stable)
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          echo "${{ steps.r2.outputs.url }}" | npx wrangler secret put PUBLIC_IMAGES_URL
          echo "Set PUBLIC_IMAGES_URL = ${{ steps.r2.outputs.url }}"