deploy.yml

name: DEPLOY — Deploy Branch

on:
  workflow_call:
    inputs:
      environment:
        description: "Target — Environment (used for Environment-scoped vars/secrets)"
        required: true
        type: string
      component:
        description: "Target — Component to deploy (triggers the matching webhook list)"
        required: true
        type: string
      confirm:
        description: "Confirm — Choose the exact deploy action (mobile-friendly)"
        required: true
        type: string
  workflow_dispatch:
    inputs:
      environment:
        description: "Target — Environment (used for Environment-scoped vars/secrets)"
        required: true
        type: choice
        default: production
        options:
          - production
          - preview
      component:
        description: "Target — Component to deploy (triggers the matching webhook list)"
        required: true
        type: choice
        options:
          - ui
          - server
          - website
          - docs
      confirm:
        description: "Confirm — Choose the exact deploy action (mobile-friendly)"
        required: true
        type: choice
        options:
          - deploy production ui
          - deploy production server
          - deploy production website
          - deploy production docs
          - deploy preview ui
          - deploy preview server
          - deploy preview website
          - deploy preview docs

permissions:
  contents: read

concurrency:
  group: deploy-${{ format('{0}/{1}', inputs.environment, inputs.component) }}
  cancel-in-progress: false

jobs:
  trusted_ref_guard:
    name: Trusted workflow ref guard
    permissions:
      contents: read
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Admit trusted workflow control ref
        env:
          CALLER_REPOSITORY: ${{ github.repository }}
          WORKFLOW_REPOSITORY: ${{ job.workflow_repository }}
          WORKFLOW_REF: ${{ job.workflow_ref }}
          WORKFLOW_FILE: deploy.yml
          EVENT_NAME: ${{ github.event_name }}
        run: |
          set -euo pipefail
          test "$CALLER_REPOSITORY" = "$WORKFLOW_REPOSITORY"
          case "$EVENT_NAME" in
            workflow_dispatch|workflow_call|push) ;;
            *) echo "Unsupported deploy workflow event: $EVENT_NAME" >&2; exit 1 ;;
          esac
          case "$WORKFLOW_REF" in
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/dev"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/preview"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/main"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/deploy/preview/ui"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/deploy/preview/server"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/deploy/preview/website"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/deploy/preview/docs"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/deploy/production/ui"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/deploy/production/server"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/deploy/production/website"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/deploy/production/docs") ;;
            *) echo "Untrusted workflow control ref: $WORKFLOW_REF" >&2; exit 1 ;;
          esac

  release_actor_guard:
    needs: [trusted_ref_guard]
    name: Release actor guard
    permissions:
      contents: read
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout trusted workflow control bytes
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          repository: ${{ job.workflow_repository }}
          ref: ${{ job.workflow_sha }}
          persist-credentials: false
      - name: Authorize release actor
        uses: ./.github/actions/release-actor-guard
        with:
          team_slug: release-admins
          trusted_actors: happier-release-bot[bot]
          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}

  deploy:
    needs: [release_actor_guard]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    if: ${{ needs.release_actor_guard.result == 'success' }}
    environment: ${{ inputs.environment }}
    steps:
      - name: Checkout trusted workflow control bytes
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          repository: ${{ job.workflow_repository }}
          ref: ${{ job.workflow_sha }}
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version-file: .node-version

      - name: Enforce trusted refs for manual dispatch
        run: |
          set -euo pipefail
          if [ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]; then
            exit 0
          fi
          case "${GITHUB_REF_NAME}" in
            dev|preview|main|\
            deploy/preview/ui|deploy/preview/server|deploy/preview/website|deploy/preview/docs|\
            deploy/production/ui|deploy/production/server|deploy/production/website|deploy/production/docs) ;;
            *)
              echo "Refusing workflow_dispatch from untrusted ref '${GITHUB_REF_NAME}'. Use dev, preview, main, or a canonical deploy/<preview|production>/<ui|server|website|docs> ref." >&2
              exit 1
              ;;
          esac

      - name: Resolve target (env + component)
        id: target
        env:
          EVENT_NAME: ${{ github.event_name }}
          INPUT_ENV: ${{ inputs.environment }}
          INPUT_COMPONENT: ${{ inputs.component }}
          INPUT_CONFIRM: ${{ inputs.confirm }}
        run: |
          set -euo pipefail

          # Called workflows inherit `github.event_name` from the caller (e.g. `push`), so we must accept it here.
          if [ "$EVENT_NAME" != "workflow_dispatch" ] && [ "$EVENT_NAME" != "workflow_call" ] && [ "$EVENT_NAME" != "push" ]; then
            echo "Unsupported event for deploy workflow: $EVENT_NAME" >&2
            exit 1
          fi

          env_name="$INPUT_ENV"
          component="$INPUT_COMPONENT"
          expected="deploy ${env_name} ${component}"
          if [ "$INPUT_CONFIRM" != "$expected" ]; then
            echo "Confirmation mismatch." >&2
            echo "Expected: $expected" >&2
            echo "Got:      $INPUT_CONFIRM" >&2
            exit 1
          fi

          case "$env_name" in
            production|preview) ;;
            *)
              echo "Unsupported environment: $env_name" >&2
              exit 1
              ;;
          esac

          case "$component" in
            ui|server|website|docs) ;;
            *)
              echo "Unsupported component: $component" >&2
              exit 1
              ;;
          esac

          echo "environment=$env_name" >> "$GITHUB_OUTPUT"
          echo "component=$component" >> "$GITHUB_OUTPUT"

          {
            echo "## Deploy trigger"
            echo ""
            echo "- ref: \`${GITHUB_REF_NAME}\`"
            echo "- environment: \`$env_name\`"
            echo "- component: \`$component\`"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Trigger deploy webhook(s)
        env:
          GH_TOKEN: ${{ github.token }}
          DEPLOY_ENVIRONMENT: ${{ steps.target.outputs.environment }}
          DEPLOY_COMPONENT: ${{ steps.target.outputs.component }}
          DEPLOY_REPOSITORY: ${{ github.repository }}
          DEPLOY_REF_NAME: deploy/${{ steps.target.outputs.environment }}/${{ steps.target.outputs.component }}
          CF_WEBHOOK_DEPLOY_CLIENT_ID: ${{ secrets.CF_WEBHOOK_DEPLOY_CLIENT_ID }}
          CF_WEBHOOK_DEPLOY_CLIENT_SECRET: ${{ secrets.CF_WEBHOOK_DEPLOY_CLIENT_SECRET }}
          DEPLOY_WEBHOOK_URL: ${{ vars.DEPLOY_WEBHOOK_URL != '' && vars.DEPLOY_WEBHOOK_URL || secrets.DEPLOY_WEBHOOK_URL }}
          HAPPIER_UI_DEPLOY_WEBHOOKS: ${{ vars.HAPPIER_UI_DEPLOY_WEBHOOKS != '' && vars.HAPPIER_UI_DEPLOY_WEBHOOKS || secrets.HAPPIER_UI_DEPLOY_WEBHOOKS }}
          HAPPIER_WEBSITE_DEPLOY_WEBHOOKS: ${{ vars.HAPPIER_WEBSITE_DEPLOY_WEBHOOKS != '' && vars.HAPPIER_WEBSITE_DEPLOY_WEBHOOKS || secrets.HAPPIER_WEBSITE_DEPLOY_WEBHOOKS }}
          HAPPIER_DOCS_DEPLOY_WEBHOOKS: ${{ vars.HAPPIER_DOCS_DEPLOY_WEBHOOKS != '' && vars.HAPPIER_DOCS_DEPLOY_WEBHOOKS || secrets.HAPPIER_DOCS_DEPLOY_WEBHOOKS }}
          HAPPIER_SERVER_API_DEPLOY_WEBHOOKS: ${{ vars.HAPPIER_SERVER_API_DEPLOY_WEBHOOKS != '' && vars.HAPPIER_SERVER_API_DEPLOY_WEBHOOKS || secrets.HAPPIER_SERVER_API_DEPLOY_WEBHOOKS }}
          HAPPIER_SERVER_WORKER_DEPLOY_WEBHOOKS: ${{ vars.HAPPIER_SERVER_WORKER_DEPLOY_WEBHOOKS != '' && vars.HAPPIER_SERVER_WORKER_DEPLOY_WEBHOOKS || secrets.HAPPIER_SERVER_WORKER_DEPLOY_WEBHOOKS }}
        run: |
          set -euo pipefail
          node scripts/pipeline/run.mjs deploy \
            --deploy-environment "$DEPLOY_ENVIRONMENT" \
            --component "$DEPLOY_COMPONENT" \
            --repository "$DEPLOY_REPOSITORY" \
            --ref-name "$DEPLOY_REF_NAME"