void/.github/workflows/platform-deploy.yml at main · voidzero-dev/void · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
name: Deploy Platform Production

on:
  push:
    # `prod` is the production ref: it holds the commit that is live, and
    # advancing it is the release. No path filter — a push here is deliberate.
    branches: [prod]
  workflow_dispatch:

concurrency:
  # One running deploy plus at most one pending. Never interrupt a deploy
  # between the api migration and the workers that depend on it.
  group: platform-deploy-production
  cancel-in-progress: false

permissions: {}

jobs:
  check-ref:
    if: ${{ vars.VOID_PLATFORM_DEPLOY_ENABLED == 'true' && github.ref == 'refs/heads/prod' }}
    runs-on: ubuntu-latest
    steps:
      # Actions string comparisons ignore case. Check before entering Prod.
      - name: Verify the exact production branch
        run: test "$GITHUB_REF" = 'refs/heads/prod'

  ci:
    if: ${{ vars.VOID_PLATFORM_DEPLOY_ENABLED == 'true' && github.ref == 'refs/heads/prod' }}
    needs: check-ref
    uses: ./.github/workflows/platform-ci.yml
    with:
      # Automatic and manual production runs use the prod ref and must pass
      # the schema-compatibility guard.
      require-schema-compat: true
    permissions:
      contents: read
      deployments: read

  deploy:
    if: ${{ vars.VOID_PLATFORM_DEPLOY_ENABLED == 'true' && github.ref == 'refs/heads/prod' }}
    needs: ci
    runs-on: blacksmith-4vcpu-ubuntu-2404
    environment: Prod
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: voidzero-dev/setup-vp@1b32467adbe183473499fd9d5d372c3ed9641754 # v1.18.0
        with:
          cache: true
          node-version-file: .node-version
      - run: vp run build
      - run: vp run --filter @voidcloud/platform deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          EMAIL_SIGNING_SECRET: ${{ secrets.EMAIL_SIGNING_SECRET }}