deploy-update.yml

name: deploy-update

# Deploys the update Worker (services/update). Production only.
#
# - build runs repository code (typecheck and `wrangler deploy --dry-run`) with
#   no environment and no secrets, and uploads only the bundled index.js with a
#   SHA256SUMS whose digest it reports.
# - deploy runs in the production environment and mints a short-lived Cloudflare
#   token from the token issuer. It checks out only .github/release/, verifies
#   the artifact against that digest, installs the wrangler CLI pinned in
#   .github/release/wrangler, and runs only .github/release/deploy-update.sh.
#   The Worker's name, routes, custom domain, D1 database and Pipelines stream
#   are the complete pinned wrangler.json in .github/release/targets/update/.
on:
  push:
    branches:
      - production
  workflow_dispatch:

concurrency:
  group: deploy-update-${{ github.ref_name }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  update-build:
    if: github.repository == 'anomalyco/opencode' && github.ref_name == 'production'
    runs-on: blacksmith-4vcpu-ubuntu-2404
    outputs:
      digest: ${{ steps.upload.outputs.digest }}
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          ref: ${{ github.sha }}
          persist-credentials: false

      - uses: ./.github/actions/setup-bun

      - name: Typecheck
        working-directory: services/update
        run: bun run typecheck:tsc

      - name: Build
        working-directory: services/update
        run: |
          artifact="$RUNNER_TEMP/update-artifact"
          rm -rf "$artifact"
          ./node_modules/.bin/wrangler deploy --dry-run --outdir "$artifact"
          # wrangler writes a README next to the bundle; the deploy only needs index.js.
          rm -f "$artifact/README.md" "$artifact/index.js.map"

      - id: upload
        uses: ./.github/release/upload
        with:
          name: update-production
          path: ${{ runner.temp }}/update-artifact
          retention-days: 7
          include-hidden-files: true

  update-deploy:
    needs: update-build
    if: github.repository == 'anomalyco/opencode' && github.ref_name == 'production'
    runs-on: blacksmith-4vcpu-ubuntu-2404
    environment: production
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Check out the deploy scripts
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          ref: ${{ github.sha }}
          sparse-checkout: /.github/release/
          sparse-checkout-cone-mode: false
          persist-credentials: false

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "24"

      - name: Install the pinned wrangler CLI
        working-directory: .github/release/wrangler
        run: npm ci --ignore-scripts --no-audit --no-fund

      - name: Download
        uses: ./.github/release/download
        with:
          pattern: update-production
          require-digests: true
          digests: update-production=${{ needs.update-build.outputs.digest }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: arn:aws:iam::604439173067:role/github/opencode-production
          role-session-name: opencode-${{ github.run_id }}
          aws-region: us-east-1

      # A 15-minute token for production, minted by the token issuer (anomalyco/secrets) from the role above.
      # It is a step output, so only the Deploy step gets it.
      - name: Cloudflare token
        id: cloudflare-token
        run: bash .github/release/cloudflare-token.sh
        env:
          CLOUDFLARE_TOKEN_URL: ${{ vars.CLOUDFLARE_TOKEN_URL }}

      - name: Deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ steps.cloudflare-token.outputs.token }}
        run: bash .github/release/deploy-update.sh production "$RUNNER_TEMP/in/update-production"