deploy.yml

name: Deploy Inkrypt

on:
  workflow_dispatch:
    inputs:
      domain:
        description: 'Custom domain (e.g. notes.example.com)'
        required: true
        type: string
      rp_name:
        description: 'RP_NAME (default: Inkrypt)'
        required: false
        default: 'Inkrypt'
        type: string
      cookie_samesite:
        description: 'COOKIE_SAMESITE (default: Lax)'
        required: false
        default: 'Lax'
        type: string
      cors_origin:
        description: 'CORS_ORIGIN (default: https://<DOMAIN>, comma-separated allowed)'
        required: false
        default: ''
        type: string
      pages_project_name:
        description: 'Override Pages project name (optional)'
        required: false
        default: ''
        type: string
      worker_name:
        description: 'Override Worker name (optional)'
        required: false
        default: ''
        type: string
      d1_name:
        description: 'Override D1 database name (optional)'
        required: false
        default: ''
        type: string
      d1_location:
        description: 'D1 location hint (weur/eeur/apac/oc/wnam/enam) (optional)'
        required: false
        default: ''
        type: string
      force_takeover_dns:
        description: 'Override existing DNS record if it differs (true/false)'
        required: false
        default: 'false'
        type: string
      force_takeover_routes:
        description: 'Override existing Worker routes if they differ (true/false)'
        required: false
        default: 'false'
        type: string
      wait_for_tls:
        description: 'Wait until https://<DOMAIN> becomes reachable (true/false)'
        required: false
        default: 'true'
        type: string

concurrency:
  group: inkrypt-deploy-${{ github.repository }}-${{ inputs.domain }}
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    env:
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      DOMAIN: ${{ inputs.domain }}

      # Optional overrides
      INKRYPT_RP_NAME: ${{ inputs.rp_name }}
      INKRYPT_COOKIE_SAMESITE: ${{ inputs.cookie_samesite }}
      INKRYPT_CORS_ORIGIN: ${{ inputs.cors_origin }}
      INKRYPT_PAGES_PROJECT_NAME: ${{ inputs.pages_project_name }}
      INKRYPT_WORKER_NAME: ${{ inputs.worker_name }}
      INKRYPT_D1_NAME: ${{ inputs.d1_name }}

      # Safety toggles
      FORCE_TAKEOVER_DNS: ${{ inputs.force_takeover_dns }}
      FORCE_TAKEOVER_ROUTES: ${{ inputs.force_takeover_routes }}
      WAIT_FOR_TLS: ${{ inputs.wait_for_tls }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Install deps
        run: npm ci

      - name: Resolve deploy config
        id: cfg
        run: node deploy/name.mjs

      - name: Resolve Cloudflare zone/account
        id: zone
        run: node deploy/cf-api.mjs resolve-zone --domain "${{ steps.cfg.outputs.domain }}"

      - name: Export Cloudflare Account ID
        run: |
          echo "CLOUDFLARE_ACCOUNT_ID=${{ steps.zone.outputs.account_id }}" >> "$GITHUB_ENV"
          echo "CLOUDFLARE_ZONE_ID=${{ steps.zone.outputs.zone_id }}" >> "$GITHUB_ENV"

      - name: Ensure Pages project exists
        run: node deploy/cf-api.mjs ensure-pages-project --account-id "${{ steps.zone.outputs.account_id }}" --project-name "${{ steps.cfg.outputs.pages_project_name }}" --production-branch main

      - name: Build web
        run: npm --workspace apps/web run build

      - name: Deploy Pages (Direct Upload)
        uses: cloudflare/pages-action@v1
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ steps.zone.outputs.account_id }}
          projectName: ${{ steps.cfg.outputs.pages_project_name }}
          directory: apps/web/dist
          branch: main

      - name: Bind custom domain + DNS (Pages)
        run: node deploy/cf-api.mjs ensure-pages-domain --domain "${{ steps.cfg.outputs.domain }}" --account-id "${{ steps.zone.outputs.account_id }}" --project-name "${{ steps.cfg.outputs.pages_project_name }}" --zone-id "${{ steps.zone.outputs.zone_id }}" --cname-target "${{ steps.cfg.outputs.cname_target }}"

      - name: Ensure D1 exists
        id: d1
        shell: bash
        run: |
          set -euo pipefail
          name="${{ steps.cfg.outputs.d1_name }}"

          echo "Looking up D1 database: $name"
          db_json="$(npx wrangler d1 list --json)"
          db_id="$(node -e 'const fs=require("fs"); const name=process.argv[1]; const raw=JSON.parse(fs.readFileSync(0,"utf8")); const list=Array.isArray(raw)?raw:(Array.isArray(raw?.result)?raw.result:[]); const hit=list.find(d=>d && d.name===name); const id=hit?.uuid ?? hit?.database_id ?? hit?.id ?? hit?.databaseId; if(id) process.stdout.write(String(id));' "$name" <<<"$db_json")"

          if [ -z "${db_id}" ]; then
            echo "Creating D1 database: $name"
            if [ -n "${{ inputs.d1_location }}" ]; then
              npx wrangler d1 create "$name" --location "${{ inputs.d1_location }}"
            else
              npx wrangler d1 create "$name"
            fi

            db_json="$(npx wrangler d1 list --json)"
            db_id="$(node -e 'const fs=require("fs"); const name=process.argv[1]; const raw=JSON.parse(fs.readFileSync(0,"utf8")); const list=Array.isArray(raw)?raw:(Array.isArray(raw?.result)?raw.result:[]); const hit=list.find(d=>d && d.name===name); const id=hit?.uuid ?? hit?.database_id ?? hit?.id ?? hit?.databaseId; if(id) process.stdout.write(String(id));' "$name" <<<"$db_json")"
          fi

          if [ -z "${db_id}" ]; then
            echo "Failed to resolve D1 uuid for $name" >&2
            exit 1
          fi

          echo "INKRYPT_D1_ID=$db_id" >> "$GITHUB_ENV"
          echo "d1_id=$db_id" >> "$GITHUB_OUTPUT"

      - name: Render Worker config (wrangler.toml)
        run: |
          node deploy/render-worker-config.mjs \
            --account-id "${{ steps.zone.outputs.account_id }}" \
            --worker-name "${{ steps.cfg.outputs.worker_name }}" \
            --d1-name "${{ steps.cfg.outputs.d1_name }}" \
            --d1-id "${{ steps.d1.outputs.d1_id }}" \
            --rp-name "${{ steps.cfg.outputs.rp_name }}" \
            --rp-id "${{ steps.cfg.outputs.rp_id }}" \
            --origin "${{ steps.cfg.outputs.origin }}" \
            --cors-origin "${{ steps.cfg.outputs.cors_origin }}" \
            --cookie-samesite "${{ steps.cfg.outputs.cookie_samesite }}"

      - name: Apply D1 migrations
        run: npx wrangler d1 migrations apply "${{ steps.cfg.outputs.d1_name }}" --remote --cwd apps/worker --config wrangler.toml

      - name: Resolve SESSION_SECRET
        shell: bash
        run: |
          set -euo pipefail
          if [ -n "${{ secrets.INKRYPT_SESSION_SECRET }}" ]; then
            secret="${{ secrets.INKRYPT_SESSION_SECRET }}"
          else
            secret="$(node -e 'console.log(require("crypto").randomBytes(48).toString("base64"))')"
          fi
          echo "::add-mask::$secret"
          echo "SESSION_SECRET=$secret" >> "$GITHUB_ENV"

      - name: Put Worker secret
        shell: bash
        run: |
          set -euo pipefail
          printf '%s' "$SESSION_SECRET" | npx wrangler secret put SESSION_SECRET --name "${{ steps.cfg.outputs.worker_name }}" --cwd apps/worker --config wrangler.toml

      - name: Deploy Worker
        run: npx wrangler deploy --name "${{ steps.cfg.outputs.worker_name }}" --cwd apps/worker --config wrangler.toml

      - name: Ensure Worker routes
        run: node deploy/cf-api.mjs ensure-worker-routes --zone-id "${{ steps.zone.outputs.zone_id }}" --worker-name "${{ steps.cfg.outputs.worker_name }}" --route "${{ steps.cfg.outputs.domain }}/api/*,${{ steps.cfg.outputs.domain }}/auth/*,${{ steps.cfg.outputs.domain }}/healthz*"

      - name: Smoke test
        shell: bash
        run: |
          set -euo pipefail
          echo "Checking https://${{ steps.cfg.outputs.domain }}/healthz"
          curl -fsS "https://${{ steps.cfg.outputs.domain }}/healthz" >/dev/null