deploy.yml

name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-production
  cancel-in-progress: false

# CI is not a user — see the note in ci.yml. Applied to every workflow rather
# than the ones that look like they run product code: the first pass guessed,
# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
# where the product is not executed, so the blanket application is the cheap
# structural answer.
env:
  DO_NOT_TRACK: "1"
  EXECUTOR_DISABLE_ANALYTICS: "1"
  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"

jobs:
  migrate:
    name: Migrate database
    runs-on: blacksmith-4vcpu-ubuntu-2404
    environment: production
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.11

      - name: Cache Bun package cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-1.3.11-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-1.3.11-

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run migrations
        run: bun run scripts/migrate.ts --bucket executor-cloud-blobs
        working-directory: apps/cloud
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      # The build below authorizes every request from the local membership
      # mirror. This runs the mirror backfill if it has not completed, drains
      # the WorkOS events stream itself if the reconciler has not recently
      # (it does not wait on the cron, which this same deploy may be the one
      # to ship), and FAILS the deploy if the mirror is still not ready — see
      # scripts/ensure-workos-mirror-ready.ts.
      - name: Backfill and verify the membership mirror
        run: bun run scripts/ensure-workos-mirror-ready.ts
        working-directory: apps/cloud
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          WORKOS_API_KEY: ${{ secrets.WORKOS_API_KEY }}

  deploy-cloud:
    name: Deploy cloud
    runs-on: blacksmith-4vcpu-ubuntu-2404
    environment: production
    needs: migrate
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.11

      - name: Cache Bun package cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-1.3.11-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-1.3.11-

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build cloud
        run: bun run --cwd apps/cloud build
        env:
          VITE_PUBLIC_SENTRY_DSN: ${{ secrets.VITE_PUBLIC_SENTRY_DSN }}

      - name: Deploy cloud
        run: bun run wrangler deploy -c dist/server/wrangler.json --var GIT_COMMIT_SHA:${{ github.sha }}
        working-directory: apps/cloud
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      # Deploy marker: one event per deploy into the same Axiom dataset the
      # worker traces land in, so a latency step-change lines up with its
      # deploy in one query. Skipped (not failed) when the secret is absent,
      # and never blocks the deploy.
      - name: Record deploy marker in Axiom
        env:
          AXIOM_INGEST_TOKEN: ${{ secrets.AXIOM_INGEST_TOKEN }}
        run: |
          if [ -z "$AXIOM_INGEST_TOKEN" ]; then
            echo "AXIOM_INGEST_TOKEN not configured; skipping deploy marker"
            exit 0
          fi
          curl -sf -X POST "https://api.axiom.co/v1/datasets/executor-cloud/ingest" \
            -H "Authorization: Bearer $AXIOM_INGEST_TOKEN" \
            -H "Content-Type: application/json" \
            -d "[{\"event\":\"deploy\",\"service\":\"executor-cloud\",\"commit_sha\":\"${{ github.sha }}\",\"actor\":\"${{ github.actor }}\",\"run_id\":\"${{ github.run_id }}\"}]" \
            || echo "deploy marker ingest failed (non-blocking)"

  deploy-marketing:
    name: Deploy marketing
    runs-on: blacksmith-4vcpu-ubuntu-2404
    environment: production
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.11

      - name: Cache Bun package cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-1.3.11-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-1.3.11-

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build marketing
        run: bun run --cwd apps/marketing build

      - name: Deploy marketing
        run: bun run wrangler deploy --config dist/server/wrangler.json
        working-directory: apps/marketing
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}