From be522287bb872a8537e8376db539674c254afed5 Mon Sep 17 00:00:00 2001
From: Matt Lehman <matt@greynoise.io>
Date: Mon, 9 Feb 2026 22:14:54 -0500
Subject: [PATCH] Add Fly GitHub Actions deploy workflow

---
 .github/workflows/fly-deploy.yml | 44 ++++++++++++++++++++++++++++++++
 .gitignore                       |  1 +
 README.md                        |  1 +
 docs/fly-api-rollout.md          | 16 ++++++++++++
 interview-app/.gitignore         |  1 +
 interview-app/test.js            |  1 +
 6 files changed, 64 insertions(+)
 create mode 100644 .github/workflows/fly-deploy.yml

diff --git a/.github/workflows/fly-deploy.yml b/.github/workflows/fly-deploy.yml
new file mode 100644
index 0000000..84f5ac7
--- /dev/null
+++ b/.github/workflows/fly-deploy.yml
@@ -0,0 +1,44 @@
+name: Deploy Fly API
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'interview-app/**'
+      - '.github/workflows/fly-deploy.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fly-main
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    name: Deploy interview-app to Fly
+    runs-on: ubuntu-latest
+    env:
+      FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
+      FLY_APP_NAME: ${{ vars.FLY_APP_NAME }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup flyctl
+        uses: superfly/flyctl-actions/setup-flyctl@master
+
+      - name: Deploy
+        run: |
+          if [ -z "${FLY_API_TOKEN}" ]; then
+            echo "Missing FLY_API_TOKEN secret; skipping deploy."
+            exit 0
+          fi
+
+          APP_NAME="${FLY_APP_NAME:-yappybara-api}"
+          echo "Deploying to Fly app: ${APP_NAME}"
+          flyctl deploy \
+            --remote-only \
+            --app "${APP_NAME}" \
+            --config interview-app/fly.toml.example
diff --git a/.gitignore b/.gitignore
index 63f1d9b..f4c41c3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -70,6 +70,7 @@ interview-app/.resume-context.md
 interview-app/.conversation-backup.json
 interview-app/last-fix.md
 interview-app/build-summary.md
+interview-app/builds/
 interview-app/public/builds/
 interview-app/fly.toml
 interview-app/.fly/
diff --git a/README.md b/README.md
index 7b62279..fe61221 100644
--- a/README.md
+++ b/README.md
@@ -123,6 +123,7 @@ This repo includes a cheap static website in `site/` for `https://yappybara.dev`
 Deploy docs: `docs/github-pages.md`
 Distribution docs: `docs/distribution.md`
 Fly API rollout docs: `docs/fly-api-rollout.md`
+Fly CI deploy workflow: `.github/workflows/fly-deploy.yml`
 Family launch docs: `docs/family-launch.md`
 Deploy queue docs: `docs/deploy-queue.md`
 Legal/supervision docs: `docs/legal-supervision.md`
diff --git a/docs/fly-api-rollout.md b/docs/fly-api-rollout.md
index f1ce0bc..6e89cc7 100644
--- a/docs/fly-api-rollout.md
+++ b/docs/fly-api-rollout.md
@@ -62,6 +62,22 @@ Smoke test:
 curl -s https://yappybara-api.fly.dev/api/health
 ```
 
+## GitHub auto-deploy
+
+This repo includes `.github/workflows/fly-deploy.yml`.
+
+On every push to `main` that touches `interview-app/`, GitHub Actions runs:
+
+```bash
+flyctl deploy --remote-only --config interview-app/fly.toml.example
+```
+
+Configure in GitHub:
+
+1. Add repository secret `FLY_API_TOKEN`.
+2. Optional: add repository variable `FLY_APP_NAME` if app name is not `yappybara-api`.
+3. Ensure Fly app + volume already exist before first workflow run.
+
 ## Domain wiring
 
 1. Keep root/apex (`yappybara.dev`) on GitHub Pages.
diff --git a/interview-app/.gitignore b/interview-app/.gitignore
index a8d3c00..9036f10 100644
--- a/interview-app/.gitignore
+++ b/interview-app/.gitignore
@@ -24,6 +24,7 @@ build-summary.md
 last-fix.md
 
 # Generated content
+builds/
 public/builds/
 uploads/*
 !uploads/.gitkeep
diff --git a/interview-app/test.js b/interview-app/test.js
index 664c76a..2ff0dc7 100644
--- a/interview-app/test.js
+++ b/interview-app/test.js
@@ -1130,6 +1130,7 @@ describe('Repository Hygiene', () => {
     const appIgnorePath = path.resolve(__dirname, '.gitignore');
     const appIgnore = fs.readFileSync(appIgnorePath, 'utf-8');
     assert.ok(appIgnore.includes('certs/'));
+    assert.ok(appIgnore.includes('builds/'));
     assert.ok(appIgnore.includes('apps.json'));
     assert.ok(appIgnore.includes('data/'));
     assert.ok(appIgnore.includes('uploads/*'));