deploy.yml

name: Production Deploy

# Requires repository secrets:
# - CLOUDFLARE_ACCOUNT_ID: Cloudflare account ID for the worker.
# - CLOUDFLARE_API_TOKEN: Token with Workers Scripts Edit permissions.
#
# Requires production environment variables:
# - BETTER_AUTH_URL: Production domain URL (e.g., https://startkit.dev)
# - OAUTH_GITHUB_CLIENT_ID: GitHub OAuth app client ID
#
# Requires production environment secrets:
# - BETTER_AUTH_SECRET: Better Auth secret key
# - OAUTH_GITHUB_CLIENT_SECRET: GitHub OAuth app client secret

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read
  deployments: write

# Prevent multiple production deployments from running simultaneously
# Ensures deployments complete in order without race conditions
concurrency:
  group: production-deploy
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Install dependencies
        uses: ./.github/actions/setup

      - name: Run code quality checks
        run: bun run check

      - name: Build project
        run: bun run build

      - name: Run database migrations
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: d1 migrations apply DB --remote
          packageManager: bun

      - name: Deploy Worker
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: deploy
          packageManager: bun
          vars: |
            BETTER_AUTH_URL
            OAUTH_GITHUB_CLIENT_ID
          secrets: |
            BETTER_AUTH_SECRET
            OAUTH_GITHUB_CLIENT_SECRET
        env:
          BETTER_AUTH_URL: ${{ vars.BETTER_AUTH_URL }}
          BETTER_AUTH_SECRET: ${{ secrets.BETTER_AUTH_SECRET }}
          OAUTH_GITHUB_CLIENT_ID: ${{ vars.OAUTH_GITHUB_CLIENT_ID }}
          OAUTH_GITHUB_CLIENT_SECRET: ${{ secrets.OAUTH_GITHUB_CLIENT_SECRET }}

      - name: Summarize deployment
        if: success()
        run: |
          {
            echo "### Deployed"
            if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
              echo "Triggered manually via workflow_dispatch"
            else
              echo "Triggered by push to main"
            fi
            echo "Commit: ${{ github.sha }}"
          } >>"$GITHUB_STEP_SUMMARY"