deploy.yml

name: Deploy Web (Cloudflare)

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: deploy-web-production
  cancel-in-progress: false

permissions:
  # write so the IndexNow step can commit the updated sitemap snapshot back.
  contents: write

jobs:
  deploy-production:
    name: Deploy production
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          # Full history so the IndexNow step can diff this deploy's commit range.
          fetch-depth: 0
          # Don't leave a write-capable token in git config for the build /
          # deploy steps. The snapshot push below supplies its own scoped token.
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Verify recommended-flow release pins
        run: npm run verify:recommended-flows

      - name: Build OpenNext (Cloudflare)
        working-directory: web
        env:
          NEXT_PUBLIC_POSTHOG_HOST: ${{ vars.NEXT_PUBLIC_POSTHOG_HOST || 'https://i.agentrelay.com' }}
          NEXT_PUBLIC_POSTHOG_KEY: ${{ vars.NEXT_PUBLIC_POSTHOG_KEY }}
        run: npm run cf:build

      # Copy the prerendered SSG cache into the assets bundle
      # (assets/cdn-cgi/_next_cache). The site serves blog/docs pages from the
      # static-assets incremental cache; without this the Worker falls back to
      # on-demand MDX rendering, which fails in the Workers runtime (500). The
      # bare `wrangler deploy` below does not run this, so do it here.
      - name: Populate static-assets cache
        working-directory: web
        run: npx opennextjs-cloudflare populateCache remote

      - name: Deploy to Cloudflare
        working-directory: web
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
        run: npx wrangler deploy

      # Ping IndexNow (Bing/Yandex/Seznam/Naver/DuckDuckGo — not Google) with the
      # pages new or changed in this deploy. Diffs the freshly deployed sitemap
      # against the committed snapshot (web/indexnow-state.json) for new pages
      # and the git range for content edits — never the whole site. Production
      # only; never runs on PR previews. The key is intentionally public (it is
      # served at /<key>.txt for IndexNow to verify), so it lives inline. It is
      # fixed to match the committed web/public/<key>.txt — overriding it would
      # point keyLocation at a .txt this repo doesn't publish, failing validation.
      - name: Notify IndexNow of changed pages
        # Best-effort SEO ping after a successful deploy — never fail the deploy
        # over a search-engine notification.
        continue-on-error: true
        working-directory: web
        env:
          INDEXNOW_KEY: d15f21b935684761ad607fb06b70b3d5
          SITE_URL: https://agentrelay.com
        run: node scripts/indexnow-submit.mjs "${{ github.event.before }}" "${{ github.sha }}"

      # Persist the updated sitemap snapshot so the next deploy diffs against it.
      # [skip ci] keeps this commit from re-triggering the deploy workflow. Guard
      # to main so a workflow_dispatch from another ref can't fast-forward main
      # with that ref's commits. Auth is a scoped token here, not persisted creds.
      - name: Commit updated IndexNow snapshot
        if: github.ref == 'refs/heads/main'
        continue-on-error: true
        working-directory: web
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if git diff --quiet -- indexnow-state.json; then
            echo "indexnow: snapshot unchanged — nothing to commit."
            exit 0
          fi
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add indexnow-state.json
          git commit -m "chore(seo): update IndexNow sitemap snapshot [skip ci]"
          git push "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" HEAD:main