name: Deploy

on:
  push:
    branches: [main]

permissions:
  contents: read
  deployments: write

concurrency:
  group: deploy
  cancel-in-progress: false

jobs:
  staging:
    environment: staging
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck && pnpm test && pnpm build
        env:
          APP_URL: "${{ vars.APP_URL }}"
          SITE_URL: "${{ vars.SITE_URL }}"
      - run: pnpm dlx trestlejs@latest secrets check --env staging
        env: { TRESTLE_MASTER_KEY: "${{ secrets.TRESTLE_MASTER_KEY }}" }
      - name: Migrate staging
        run: DATABASE_URL="$(pnpm dlx trestlejs@latest secrets get DATABASE_MIGRATION_URL --env staging --raw)" pnpm db:migrate
        env: { TRESTLE_MASTER_KEY: "${{ secrets.TRESTLE_MASTER_KEY }}" }
      - run: pnpm dlx trestlejs@latest secrets push --env staging
        env:
          TRESTLE_MASTER_KEY: "${{ secrets.TRESTLE_MASTER_KEY }}"
          CLOUDFLARE_API_TOKEN: "${{ secrets.CLOUDFLARE_API_TOKEN }}"
          CLOUDFLARE_ACCOUNT_ID: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}"
      - uses: cloudflare/wrangler-action@v3
        with:
          apiToken: "${{ secrets.CLOUDFLARE_API_TOKEN }}"
          accountId: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}"
          packageManager: pnpm
          workingDirectory: apps/worker
          command: deploy --env staging --var WEB_ORIGIN:${{ vars.APP_URL }}
      - run: VITE_API_ORIGIN="${{ vars.API_URL }}" pnpm --filter @__TRESTLE_PROJECT_NAME__/app build
      - uses: cloudflare/wrangler-action@v3
        with:
          apiToken: "${{ secrets.CLOUDFLARE_API_TOKEN }}"
          accountId: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}"
          packageManager: pnpm
          workingDirectory: apps/app
          command: pages deploy dist --project-name __TRESTLE_PROJECT_NAME__-staging --branch main
      - uses: cloudflare/wrangler-action@v3
        with:
          apiToken: "${{ secrets.CLOUDFLARE_API_TOKEN }}"
          accountId: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}"
          packageManager: pnpm
          workingDirectory: apps/site
          command: pages deploy dist --project-name __TRESTLE_PROJECT_NAME__-site-staging --branch main
      - run: node scripts/smoke.mjs
        env: { SITE_URL: "${{ vars.SITE_URL }}", APP_URL: "${{ vars.APP_URL }}", API_URL: "${{ vars.API_URL }}" }

  production:
    needs: staging
    environment: production
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck && pnpm test && pnpm build
        env:
          APP_URL: "${{ vars.APP_URL }}"
          SITE_URL: "${{ vars.SITE_URL }}"
      - run: pnpm dlx trestlejs@latest secrets check --env production
        env: { TRESTLE_MASTER_KEY: "${{ secrets.TRESTLE_MASTER_KEY }}" }
      - name: Migrate production
        run: DATABASE_URL="$(pnpm dlx trestlejs@latest secrets get DATABASE_MIGRATION_URL --env production --raw)" pnpm db:migrate
        env: { TRESTLE_MASTER_KEY: "${{ secrets.TRESTLE_MASTER_KEY }}" }
      - run: pnpm dlx trestlejs@latest secrets push --env production
        env:
          TRESTLE_MASTER_KEY: "${{ secrets.TRESTLE_MASTER_KEY }}"
          CLOUDFLARE_API_TOKEN: "${{ secrets.CLOUDFLARE_API_TOKEN }}"
          CLOUDFLARE_ACCOUNT_ID: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}"
      - uses: cloudflare/wrangler-action@v3
        with:
          apiToken: "${{ secrets.CLOUDFLARE_API_TOKEN }}"
          accountId: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}"
          packageManager: pnpm
          workingDirectory: apps/worker
          command: deploy --env production --var WEB_ORIGIN:${{ vars.APP_URL }}
      - run: VITE_API_ORIGIN="${{ vars.API_URL }}" pnpm --filter @__TRESTLE_PROJECT_NAME__/app build
      - uses: cloudflare/wrangler-action@v3
        with:
          apiToken: "${{ secrets.CLOUDFLARE_API_TOKEN }}"
          accountId: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}"
          packageManager: pnpm
          workingDirectory: apps/app
          command: pages deploy dist --project-name __TRESTLE_PROJECT_NAME__ --branch main
      - uses: cloudflare/wrangler-action@v3
        with:
          apiToken: "${{ secrets.CLOUDFLARE_API_TOKEN }}"
          accountId: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}"
          packageManager: pnpm
          workingDirectory: apps/site
          command: pages deploy dist --project-name __TRESTLE_PROJECT_NAME__-site --branch main
      - run: node scripts/smoke.mjs
        env: { SITE_URL: "${{ vars.SITE_URL }}", APP_URL: "${{ vars.APP_URL }}", API_URL: "${{ vars.API_URL }}" }