deploy-production.yml

name: Deploy Orbit to Cloudflare

on:
  push:
    branches:
      - main
    paths-ignore:
      - 'docs/**'
      - '*.md'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: orbit-production
  cancel-in-progress: true

jobs:
  frontend:
    runs-on: ubuntu-latest
    timeout-minutes: 12
    outputs:
      scope: ${{ steps.scope.outputs.scope }}
    steps:
      - name: Checkout exact production candidate and history
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Test the fail-safe classifier
        run: npm run actions:scope:test

      - name: Classify changed paths
        id: scope
        env:
          BEFORE_SHA: ${{ github.event.before }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [[ "$EVENT_NAME" == 'workflow_dispatch' || -z "$BEFORE_SHA" || "$BEFORE_SHA" =~ ^0+$ ]]; then
            printf 'scope=full\n' >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git diff --name-only "$BEFORE_SHA" "$GITHUB_SHA" | node scripts/orbit-actions-scope.mjs

      - name: Set up Node
        if: ${{ steps.scope.outputs.scope != 'docs' }}
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        if: ${{ steps.scope.outputs.scope != 'docs' }}
        run: npm ci

      - name: Build and verify the production frontend once
        if: ${{ steps.scope.outputs.scope != 'docs' }}
        run: npm run verify:frontend:production

      - name: Create the verified asset manifest
        if: ${{ steps.scope.outputs.scope != 'docs' }}
        run: |
          test "$(find dist/client -type f -path '*/.*' ! -path 'dist/client/.assetsignore' -print -quit)" = ''
          printf 'wrangler.json\n.dev.vars\n' \
            | diff --unified - dist/client/.assetsignore
          find dist/client -type f -print0 \
            | sort -z \
            | xargs -0 sha256sum > production-assets.sha256
          sha256sum dist/worker-production-live/worker.js >> production-assets.sha256
          sha256sum --check production-assets.sha256

      - name: Upload verified production assets
        if: ${{ steps.scope.outputs.scope != 'docs' }}
        uses: actions/upload-artifact@v7
        with:
          name: orbit-production-assets-${{ github.sha }}
          path: |
            dist/client
            dist/worker-production-live/worker.js
            production-assets.sha256
          if-no-files-found: error
          include-hidden-files: true
          retention-days: 1

  backend-foundation:
    runs-on: ubuntu-latest
    timeout-minutes: 12
    outputs:
      scope: ${{ steps.scope.outputs.scope }}
    steps:
      - name: Checkout foundation candidate and history
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Classify changed paths independently
        id: scope
        env:
          BEFORE_SHA: ${{ github.event.before }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [[ "$EVENT_NAME" == 'workflow_dispatch' || -z "$BEFORE_SHA" || "$BEFORE_SHA" =~ ^0+$ ]]; then
            printf 'scope=full\n' >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git diff --name-only "$BEFORE_SHA" "$GITHUB_SHA" | node scripts/orbit-actions-scope.mjs

      - name: Set up Node
        if: ${{ steps.scope.outputs.scope == 'full' }}
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        if: ${{ steps.scope.outputs.scope == 'full' }}
        run: npm ci

      - name: Verify D1 foundation, authorization and reference clients
        if: ${{ steps.scope.outputs.scope == 'full' }}
        run: npm run test:d1:core:foundation && npm run orbit:test:clients

      - name: Record frontend-only decision
        if: ${{ steps.scope.outputs.scope != 'full' }}
        run: echo 'No backend/security path changed; this validation slice is not required.'

  backend-site:
    runs-on: ubuntu-latest
    timeout-minutes: 12
    outputs:
      scope: ${{ steps.scope.outputs.scope }}
    steps:
      - name: Checkout site-auth candidate and history
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Classify changed paths independently
        id: scope
        env:
          BEFORE_SHA: ${{ github.event.before }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [[ "$EVENT_NAME" == 'workflow_dispatch' || -z "$BEFORE_SHA" || "$BEFORE_SHA" =~ ^0+$ ]]; then
            printf 'scope=full\n' >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git diff --name-only "$BEFORE_SHA" "$GITHUB_SHA" | node scripts/orbit-actions-scope.mjs

      - name: Set up Node
        if: ${{ steps.scope.outputs.scope == 'full' }}
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        if: ${{ steps.scope.outputs.scope == 'full' }}
        run: npm ci

      - name: Verify site authorization and sign-in behavior
        if: ${{ steps.scope.outputs.scope == 'full' }}
        run: npm run test:d1:core:site

      - name: Record frontend-only decision
        if: ${{ steps.scope.outputs.scope != 'full' }}
        run: echo 'No backend/security path changed; this validation slice is not required.'

  backend-public:
    runs-on: ubuntu-latest
    timeout-minutes: 12
    outputs:
      scope: ${{ steps.scope.outputs.scope }}
    steps:
      - name: Checkout public-core candidate and history
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Classify changed paths independently
        id: scope
        env:
          BEFORE_SHA: ${{ github.event.before }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [[ "$EVENT_NAME" == 'workflow_dispatch' || -z "$BEFORE_SHA" || "$BEFORE_SHA" =~ ^0+$ ]]; then
            printf 'scope=full\n' >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git diff --name-only "$BEFORE_SHA" "$GITHUB_SHA" | node scripts/orbit-actions-scope.mjs

      - name: Set up Node
        if: ${{ steps.scope.outputs.scope == 'full' }}
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        if: ${{ steps.scope.outputs.scope == 'full' }}
        run: npm ci

      - name: Verify public repository and identity behavior
        if: ${{ steps.scope.outputs.scope == 'full' }}
        run: npm run test:d1:core:public

      - name: Record frontend-only decision
        if: ${{ steps.scope.outputs.scope != 'full' }}
        run: echo 'No backend/security path changed; this validation slice is not required.'

  backend-publication:
    runs-on: ubuntu-latest
    timeout-minutes: 12
    outputs:
      scope: ${{ steps.scope.outputs.scope }}
    steps:
      - name: Checkout publication candidate and history
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Classify changed paths independently
        id: scope
        env:
          BEFORE_SHA: ${{ github.event.before }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [[ "$EVENT_NAME" == 'workflow_dispatch' || -z "$BEFORE_SHA" || "$BEFORE_SHA" =~ ^0+$ ]]; then
            printf 'scope=full\n' >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git diff --name-only "$BEFORE_SHA" "$GITHUB_SHA" | node scripts/orbit-actions-scope.mjs

      - name: Set up Node
        if: ${{ steps.scope.outputs.scope == 'full' }}
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        if: ${{ steps.scope.outputs.scope == 'full' }}
        run: npm ci

      - name: Verify publication, backup, media and dashboard behavior
        if: ${{ steps.scope.outputs.scope == 'full' }}
        run: npm run test:d1:publication

      - name: Record frontend-only publication decision
        if: ${{ steps.scope.outputs.scope != 'full' }}
        run: echo 'No backend/security path changed; publication validation is not required.'

  backend-platform:
    runs-on: ubuntu-latest
    timeout-minutes: 12
    outputs:
      scope: ${{ steps.scope.outputs.scope }}
    steps:
      - name: Checkout platform candidate and history
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Classify changed paths independently
        id: scope
        env:
          BEFORE_SHA: ${{ github.event.before }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [[ "$EVENT_NAME" == 'workflow_dispatch' || -z "$BEFORE_SHA" || "$BEFORE_SHA" =~ ^0+$ ]]; then
            printf 'scope=full\n' >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git diff --name-only "$BEFORE_SHA" "$GITHUB_SHA" | node scripts/orbit-actions-scope.mjs

      - name: Set up Node
        if: ${{ steps.scope.outputs.scope == 'full' }}
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        if: ${{ steps.scope.outputs.scope == 'full' }}
        run: npm ci

      - name: Verify dashboard, media and platform behavior
        if: ${{ steps.scope.outputs.scope == 'full' }}
        run: npm run test:d1:platform

      - name: Record frontend-only platform decision
        if: ${{ steps.scope.outputs.scope != 'full' }}
        run: echo 'No backend/security path changed; platform validation is not required.'

  deploy:
    needs:
      - frontend
      - backend-foundation
      - backend-site
      - backend-public
      - backend-publication
      - backend-platform
    if: ${{ needs.frontend.result == 'success' && needs.backend-foundation.result == 'success' && needs.backend-site.result == 'success' && needs.backend-public.result == 'success' && needs.backend-publication.result == 'success' && needs.backend-platform.result == 'success' && needs.frontend.outputs.scope != 'docs' && needs.frontend.outputs.scope == needs.backend-foundation.outputs.scope && needs.frontend.outputs.scope == needs.backend-site.outputs.scope && needs.frontend.outputs.scope == needs.backend-public.outputs.scope && needs.frontend.outputs.scope == needs.backend-publication.outputs.scope && needs.frontend.outputs.scope == needs.backend-platform.outputs.scope }}
    runs-on: ubuntu-latest
    timeout-minutes: 8
    environment:
      name: production
      url: https://orbit.sametbasbug.dev

    steps:
      - name: Checkout the verified commit
        uses: actions/checkout@v7

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm

      - name: Install deployment dependencies
        run: npm ci

      - name: Download verified production assets
        uses: actions/download-artifact@v8
        with:
          name: orbit-production-assets-${{ github.sha }}
          path: .

      - name: Verify artifact and commit identity
        run: |
          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
          sha256sum --check production-assets.sha256

      - name: Deploy the verified main artifact
        env:
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          ORBIT_LIVE_OAUTH_CLIENT_ID: ${{ secrets.ORBIT_LIVE_OAUTH_CLIENT_ID }}
          ORBIT_LIVE_OAUTH_CLIENT_SECRET: ${{ secrets.ORBIT_LIVE_OAUTH_CLIENT_SECRET }}
          ORBIT_MCP_SERVICE_SECRET_V1: ${{ secrets.ORBIT_MCP_SERVICE_SECRET_V1 }}
          ORBIT_MCP_DELEGATION_PEPPER_V1: ${{ secrets.ORBIT_MCP_DELEGATION_PEPPER_V1 }}
          ORBIT_OIDC_SIGNING_KEY_V1: ${{ secrets.ORBIT_OIDC_SIGNING_KEY_V1 }}
          ORBIT_SITE_TOKEN_PEPPER_V1: ${{ secrets.ORBIT_SITE_TOKEN_PEPPER_V1 }}
        run: |
          if [[ -z "$ORBIT_LIVE_OAUTH_CLIENT_ID" || -z "$ORBIT_LIVE_OAUTH_CLIENT_SECRET" ]]; then
            echo 'Live Google OAuth deployment secrets are missing.' >&2
            exit 1
          fi
          if [[ -z "$ORBIT_MCP_SERVICE_SECRET_V1" || -z "$ORBIT_MCP_DELEGATION_PEPPER_V1" ]]; then
            echo 'Orbit MCP production secrets are missing.' >&2
            exit 1
          fi
          # Site giriş kapısının iki sırrı. Eksikse dağıtım burada duruyor,
          # çalışma zamanında durmuyor: eksik bir imza anahtarının gerçek sonucu
          # yalnızca o kapının kapalı olması, ve kapı bunu kendi başına 503 ile
          # söylüyor. Bir kapının anahtarını kaybetmek evi yıkmamalı.
          if [[ -z "$ORBIT_OIDC_SIGNING_KEY_V1" || -z "$ORBIT_SITE_TOKEN_PEPPER_V1" ]]; then
            echo 'Orbit site sign-in production secrets are missing.' >&2
            exit 1
          fi

          oauth_secrets_file="$(mktemp)"
          trap 'rm -f "$oauth_secrets_file"' EXIT
          chmod 600 "$oauth_secrets_file"
          jq -n '{
            GOOGLE_OAUTH_CLIENT_ID: env.ORBIT_LIVE_OAUTH_CLIENT_ID,
            GOOGLE_OAUTH_CLIENT_SECRET: env.ORBIT_LIVE_OAUTH_CLIENT_SECRET,
            ORBIT_MCP_SERVICE_SECRET_V1: env.ORBIT_MCP_SERVICE_SECRET_V1,
            ORBIT_MCP_DELEGATION_PEPPER_V1: env.ORBIT_MCP_DELEGATION_PEPPER_V1,
            ORBIT_OIDC_SIGNING_KEY_V1: env.ORBIT_OIDC_SIGNING_KEY_V1,
            ORBIT_SITE_TOKEN_PEPPER_V1: env.ORBIT_SITE_TOKEN_PEPPER_V1
          }' > "$oauth_secrets_file"
          unset ORBIT_LIVE_OAUTH_CLIENT_ID ORBIT_LIVE_OAUTH_CLIENT_SECRET
          unset ORBIT_MCP_SERVICE_SECRET_V1 ORBIT_MCP_DELEGATION_PEPPER_V1
          unset ORBIT_OIDC_SIGNING_KEY_V1 ORBIT_SITE_TOKEN_PEPPER_V1

          npx wrangler d1 migrations apply DB \
            --remote \
            --config wrangler.production.live.jsonc

          short_sha="${GITHUB_SHA::12}"
          npx wrangler deploy \
            dist/worker-production-live/worker.js \
            --no-bundle \
            --config wrangler.production.live.jsonc \
            --secrets-file "$oauth_secrets_file" \
            --tag "main-${short_sha}" \
            --message "Automatic production deploy from main ${short_sha}"

      - name: Verify the live site
        run: |
          health="$(curl --fail --silent --show-error \
            --retry 8 --retry-delay 3 --retry-all-errors \
            https://orbit.sametbasbug.dev/healthz)"

          HEALTH="$health" node -e '
            const health = JSON.parse(process.env.HEALTH);
            if (health.ok !== true || health.service !== "orbit-v6" || health.environment !== "production") {
              throw new Error(`Unexpected health response: ${JSON.stringify(health)}`);
            }
          '

          headers="$(mktemp)"
          trap 'rm -f "$headers"' EXIT
          curl --fail --silent --show-error \
            --retry 8 --retry-delay 3 --retry-all-errors \
            --dump-header "$headers" --output /dev/null \
            https://orbit.sametbasbug.dev/

          grep -qi '^cf-ray:' "$headers"
          if grep -qi '^server: GitHub.com' "$headers"; then
            echo 'Live Orbit unexpectedly resolved to GitHub Pages.' >&2
            exit 1
          fi
          if grep -qi '^x-robots-tag:.*noindex' "$headers"; then
            echo 'Live Orbit unexpectedly returned a noindex header.' >&2
            exit 1
          fi

      - name: Verify the live agent contract with both reference clients
        run: |
          for attempt in {1..8}; do
            if npm run contract:live; then
              exit 0
            fi
            if [[ "$attempt" -lt 8 ]]; then
              echo "Live contract has not converged yet; retrying in 3 seconds."
              sleep 3
            fi
          done
          exit 1