Merge PR #164: promote staging → main — set GITHUB_TOKEN on prod Convex #134
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Frontend | |
| on: | |
| push: | |
| branches: [staging, main] | |
| paths: | |
| - "apps/web/**" | |
| - "packages/convex-backend/**" | |
| - ".github/workflows/frontend-cd.yml" | |
| concurrency: | |
| group: frontend-deploy-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| - name: Install dependencies | |
| run: bun install | |
| - name: Deploy Convex backend | |
| run: cd packages/convex-backend && npx convex deploy | |
| env: | |
| CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }} | |
| - name: Set Convex GITHUB_TOKEN for skill imports | |
| # skills.ts (repo skill import / SKILL.md fetch) calls the GitHub API | |
| # from Convex egress — without a token it shares the 60/req/hr anon | |
| # limit and fails. Set it on the SAME deployment CONVEX_DEPLOY_KEY | |
| # targets (prod on main, staging otherwise), idempotently, so it rotates | |
| # with the SKILLS_GITHUB_TOKEN secret. Fail-soft when the secret is unset. | |
| run: | | |
| cd packages/convex-backend | |
| if [ -n "$SKILLS_GITHUB_TOKEN" ]; then | |
| npx convex env set GITHUB_TOKEN "$SKILLS_GITHUB_TOKEN" | |
| else | |
| echo "SKILLS_GITHUB_TOKEN not set for this environment — skipping" | |
| fi | |
| env: | |
| CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }} | |
| SKILLS_GITHUB_TOKEN: ${{ secrets.SKILLS_GITHUB_TOKEN }} | |
| - name: Determine environment | |
| id: env | |
| run: | | |
| if [ "${{ github.ref }}" = "refs/heads/main" ]; then | |
| echo "worker_name=harness-web" >> "$GITHUB_OUTPUT" | |
| echo "fastapi_url=${{ secrets.FASTAPI_URL_PROD }}" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "worker_name=harness-web-staging" >> "$GITHUB_OUTPUT" | |
| echo "fastapi_url=${{ secrets.FASTAPI_URL_STAGING }}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Build frontend | |
| run: cd apps/web && bun run build | |
| env: | |
| VITE_CONVEX_URL: ${{ secrets.VITE_CONVEX_URL }} | |
| VITE_CLERK_PUBLISHABLE_KEY: ${{ secrets.VITE_CLERK_PUBLISHABLE_KEY }} | |
| CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }} | |
| VITE_FASTAPI_URL: ${{ steps.env.outputs.fastapi_url }} | |
| ARCJET_KEY: ${{ secrets.ARCJET_KEY }} | |
| - name: Set Cloudflare Worker secrets | |
| run: | | |
| echo "${{ secrets.ARCJET_KEY }}" | cd apps/web && npx wrangler secret put ARCJET_KEY --name ${{ steps.env.outputs.worker_name }} | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| # The @cloudflare/vite-plugin flattens only top-level vars into the | |
| # generated dist/server/wrangler.json and drops env.* blocks, so the | |
| # deployed Worker's RUNTIME vars otherwise stay on the top-level (dev) | |
| # defaults even for prod. That left the SSR worker serving the dev Clerk | |
| # publishable key while the client build used the prod one — a split that | |
| # breaks Convex auth (NoAuthProvider). Override per-environment at deploy | |
| # time, from the same secrets the client build uses, so the Worker | |
| # runtime matches the client. | |
| - name: Deploy to Cloudflare Workers | |
| run: | | |
| cd apps/web && npx wrangler deploy --name ${{ steps.env.outputs.worker_name }} \ | |
| --var VITE_CONVEX_URL:"$VITE_CONVEX_URL" \ | |
| --var VITE_CLERK_PUBLISHABLE_KEY:"$VITE_CLERK_PUBLISHABLE_KEY" \ | |
| --var VITE_FASTAPI_URL:"$VITE_FASTAPI_URL" | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| VITE_CONVEX_URL: ${{ secrets.VITE_CONVEX_URL }} | |
| VITE_CLERK_PUBLISHABLE_KEY: ${{ secrets.VITE_CLERK_PUBLISHABLE_KEY }} | |
| VITE_FASTAPI_URL: ${{ steps.env.outputs.fastapi_url }} |