name: deploy-web

# Auto-deploys deepseek-tui.com (Cloudflare Worker) on every push to main that
# touches the web app or any source the site auto-derives facts from.
#
# Required repo secret:
#   CLOUDFLARE_API_TOKEN — token with Workers Scripts:Edit + Workers KV:Edit
#                          + Workers Custom Domain:Edit on this account.
#
# Manual trigger via the Actions tab is also supported.

on:
  push:
    branches: [main]
    paths:
      - "web/**"
      - "Cargo.toml"
      - "crates/tui/src/config.rs"
      - "crates/tui/src/sandbox/**"
      - "crates/tui/src/main.rs"
      - "npm/deepseek-tui/package.json"
      - "CHANGELOG.md"
      - ".github/workflows/deploy-web.yml"
  workflow_dispatch:

concurrency:
  group: deploy-web
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    defaults:
      run:
        working-directory: web
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          # wrangler@4 requires Node 22+
          node-version: 22
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Build (Next.js)
        run: npm run build

      - name: Build (OpenNext for Cloudflare)
        run: npx opennextjs-cloudflare build

      - name: Verify KV ids configured
        run: npm run predeploy

      - name: Deploy to Cloudflare
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: npx wrangler deploy

      - name: Refresh fact drift after deploy
        if: success()
        env:
          CRON_SECRET: ${{ secrets.CRON_SECRET }}
        run: |
          if [ -n "$CRON_SECRET" ]; then
            curl -fsS -H "x-cron-secret: $CRON_SECRET" \
              "https://deepseek-tui.com/api/cron?task=facts-drift" || true
          fi