demo.yml

name: Demo

on:
  workflow_call:
    inputs:
      digest:
        type: string
        required: true
      version:
        type: string
        required: true
    secrets:
      CLOUDFLARE_API_TOKEN:
        required: false
      CLOUDFLARE_ACCOUNT_ID:
        required: false
  workflow_dispatch:
    inputs:
      version:
        description: Published version, for example 1.18.0
        type: string
        required: true

permissions:
  contents: read

# The release's demo job holds the same group. Runs that overlap would promote out
# of order. A called workflow gets a group of its own, so it never waits on its caller.
concurrency:
  group: ${{ github.event_name == 'workflow_dispatch' && 'stackyard-demo-deploy' || format('demo-{0}', github.run_id) }}
  cancel-in-progress: false

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  WRANGLER_VERSION: 4.151.3

jobs:
  # Dev dependencies run here. Never give this job a token.
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 40
    permissions:
      contents: read
    steps:
      # The version reaches Wrangler's command line below.
      - name: Check the version
        env:
          VERSION: ${{ inputs.version }}
        run: |
          if ! printf '%s' "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::$VERSION is not a stable version such as 1.18.0"
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: '24'

      - name: Install dev tooling
        run: npm ci

      - name: Cache Playwright browsers
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
          restore-keys: playwright-${{ runner.os }}-

      - name: Install the browser
        run: npx playwright install --with-deps chromium

      - name: Start the image in demo mode
        env:
          DIGEST: ${{ inputs.digest }}
          VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          if [ -n "$DIGEST" ]; then
            IMAGE="ghcr.io/sandobserver/stackyard@${DIGEST}"
          else
            IMAGE="ghcr.io/sandobserver/stackyard:${VERSION}"
          fi
          docker pull "$IMAGE"
          echo "Demo from $(docker inspect --format '{{index .RepoDigests 0}}' "$IMAGE")"
          docker run -d --name stackyard-demo -e DEMO_MODE=true -p 8740:80 "$IMAGE"
          for i in $(seq 1 60); do
            if curl -fsS http://127.0.0.1:8740/health >/dev/null 2>&1; then echo "up after ${i}s"; exit 0; fi
            sleep 1
          done
          echo "::error::the demo container never became healthy"
          docker logs stackyard-demo
          exit 1

      - name: Copy the web root
        run: docker cp stackyard-demo:/usr/share/nginx/html "$RUNNER_TEMP/webroot"

      - name: Tour the container
        run: node scripts/demo/tour.js discover http://127.0.0.1:8740 "$RUNNER_TEMP/tour.json"

      - name: Record the demo
        run: node scripts/demo/record.js http://127.0.0.1:8740 "$RUNNER_TEMP/tour.json" "$RUNNER_TEMP/webroot" "$RUNNER_TEMP/recording.json" 10

      - name: Build the static demo
        run: |
          set -euo pipefail
          node scripts/demo/build.js "$RUNNER_TEMP/webroot" "$RUNNER_TEMP/recording.json" demo-site
          mkdir demo-recording
          cp "$RUNNER_TEMP/tour.json" "$RUNNER_TEMP/recording.json" demo-recording/

      - name: Container logs on failure
        if: failure()
        run: docker logs stackyard-demo

      - name: Upload the static demo
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: demo-site
          path: demo-site/
          retention-days: 7

      - name: Upload the recording
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: demo-recording
          path: demo-recording/
          retention-days: 7

  upload:
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions: {}
    environment: demo
    outputs:
      url: ${{ steps.version.outputs.url }}
      id: ${{ steps.version.outputs.id }}
    steps:
      - name: Check for Cloudflare credentials
        id: creds
        env:
          TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: |
          if [ -z "$TOKEN" ]; then
            echo 'CLOUDFLARE_API_TOKEN is not set. Nothing uploaded.'
            echo 'set=false' >> "$GITHUB_OUTPUT"
          else
            echo 'set=true' >> "$GITHUB_OUTPUT"
          fi

      # The Wrangler config comes from the repository, never from the build job.
      - name: Checkout the Wrangler config
        if: steps.creds.outputs.set == 'true'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          path: repo
          sparse-checkout: scripts/demo/wrangler.jsonc
          sparse-checkout-cone-mode: false

      - name: Download the static demo
        if: steps.creds.outputs.set == 'true'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: demo-site
          path: upload/site

      # The build job runs dev dependencies. Wrangler runs in this folder with the
      # token, so it must hold web files only: no package, config or link.
      - name: Check the site holds web files only
        if: steps.creds.outputs.set == 'true'
        run: |
          set -euo pipefail
          bad=$(find upload/site \( -type l -o -name '.*' -o -name node_modules -o -name 'package*.json' \
            -o -name 'wrangler.*' -o -name '_worker.js' -o \( -type f \
            ! -regex '.*\.\(html\|js\|css\|json\|png\|jpg\|jpeg\|webp\|svg\|ico\|woff2\)$' \
            ! -name _headers ! -name _redirects ! -name 'OFL-*.txt' \) \) -print)
          if [ -n "$bad" ]; then
            echo "::error::the site holds files that are not web files:"
            printf '%s\n' "$bad"
            exit 1
          fi
          cp repo/scripts/demo/wrangler.jsonc upload/
          rm -rf repo

      # Wrangler cannot upload a version of a Worker that does not exist yet. The
      # first run creates it with a placeholder page, so nothing untested goes live.
      - name: Check the Worker exists
        id: worker
        if: steps.creds.outputs.set == 'true'
        env:
          TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          ACCOUNT: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          set -euo pipefail
          # The header comes from stdin, so the token never appears in a process list.
          code=$(printf 'Authorization: Bearer %s' "$TOKEN" | curl --silent --output /dev/null \
            --write-out '%{http_code}' --max-time 30 --header @- \
            "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/workers/scripts/stackyard-demo/settings")
          case "$code" in
            200) echo 'exists=true' >> "$GITHUB_OUTPUT" ;;
            404) echo 'exists=false' >> "$GITHUB_OUTPUT" ;;
            *) echo "::error::Cloudflare answered HTTP $code"; exit 1 ;;
          esac

      - name: Prepare the placeholder
        if: steps.creds.outputs.set == 'true' && steps.worker.outputs.exists == 'false'
        run: |
          set -euo pipefail
          mkdir -p placeholder/site
          printf '<!doctype html><meta charset="utf-8"><title>Stackyard demo</title><p>The demo is being prepared.</p>\n' > placeholder/site/index.html
          printf '/ /index.html 200\n' > placeholder/site/_redirects
          # Without the routes, so a placeholder never takes the demo address.
          node -e 'const c = JSON.parse(require("fs").readFileSync(process.argv[1], "utf8")); delete c.routes; require("fs").writeFileSync(process.argv[2], JSON.stringify(c, null, 2));' upload/wrangler.jsonc placeholder/wrangler.jsonc

      - name: Create the Worker
        if: steps.creds.outputs.set == 'true' && steps.worker.outputs.exists == 'false'
        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          wranglerVersion: ${{ env.WRANGLER_VERSION }}
          workingDirectory: placeholder
          command: deploy

      - name: Upload a version
        id: wrangler
        if: steps.creds.outputs.set == 'true'
        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          wranglerVersion: ${{ env.WRANGLER_VERSION }}
          workingDirectory: upload
          command: versions upload --tag v${{ inputs.version }} --message "Stackyard ${{ inputs.version }}"

      - name: Read the version
        id: version
        if: steps.creds.outputs.set == 'true'
        env:
          OUT: ${{ steps.wrangler.outputs.command-output }}
        run: |
          set -euo pipefail
          id=$(printf '%s\n' "$OUT" | sed -n 's/.*Worker Version ID: *\([0-9a-f-]\{36\}\).*/\1/p' | head -1)
          url=$(printf '%s\n' "$OUT" | sed -n 's/.*Version Preview URL: *\(https:[^ ]*\).*/\1/p' | head -1)
          if [ -z "$id" ] || [ -z "$url" ]; then
            echo '::error::the upload printed no version ID or preview address'
            exit 1
          fi
          echo "id=$id" >> "$GITHUB_OUTPUT"
          echo "url=$url" >> "$GITHUB_OUTPUT"
          echo "Version $id previews at $url"

  # Dev dependencies run here. Never give this job a token.
  verify:
    needs: upload
    if: needs.upload.outputs.url != ''
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: '24'

      - name: Install dev tooling
        run: npm ci

      - name: Cache Playwright browsers
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
          restore-keys: playwright-${{ runner.os }}-

      - name: Install the browser
        run: npx playwright install --with-deps chromium

      - name: Download the recording
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: demo-recording
          path: demo-recording

      - name: Tour the preview
        env:
          URL: ${{ needs.upload.outputs.url }}
        run: node scripts/demo/tour.js verify "$URL" demo-recording/tour.json demo-recording/recording.json

  # Keep verify in needs. Without it, an untested version goes live.
  promote:
    needs: [upload, verify]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions: {}
    environment: demo
    steps:
      - name: Checkout the Wrangler config
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          path: repo
          sparse-checkout: scripts/demo/wrangler.jsonc
          sparse-checkout-cone-mode: false

      - name: Prepare the config
        run: |
          set -euo pipefail
          mkdir -p promote/site
          cp repo/scripts/demo/wrangler.jsonc promote/
          rm -rf repo

      # Version uploads leave routes alone; triggers deploy applies the demo address.
      - name: Deploy the version and its address
        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          wranglerVersion: ${{ env.WRANGLER_VERSION }}
          workingDirectory: promote
          command: |
            versions deploy ${{ needs.upload.outputs.id }}@100 --yes --message "Stackyard ${{ inputs.version }}"
            triggers deploy