ci: deploy the web build to wallet.fairco.in on Cloudflare Pages

Follows CI rather than the push, so nothing reaches production that has not
typechecked, linted and passed the suite — and only a green push to this
repository's own main, since `workflow_run` fires on every conclusion including
fork pull requests.

`public/_redirects` is what makes `web.output: "single"` work on a static host:
without it every deep link and every reload away from `/` 404s. The smoke test
asserts the entry document carries the bundle THIS build emitted (an older
deployment answering 200 is not a deploy) and that a route with no file behind
it returns 200 (proves the rewrite is in force).

Needs the repository secrets CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: NateIsern

.github/workflows/deploy-web.yml

@@ -0,0 +1,98 @@
+name: Deploy Web
+
+# The browser build of the wallet (wallet.fairco.in), on Cloudflare Pages —
+# the same host every Oxy frontend uses. It follows CI rather than the push, so
+# nothing reaches production that has not typechecked, linted and passed the
+# suite first.
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-fairwallet-web
+  cancel-in-progress: false
+
+env:
+  # `workflow_run` reports the commit CI actually verified; a manual dispatch
+  # runs against the ref it was launched from.
+  DEPLOY_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+
+jobs:
+  deploy:
+    # `workflow_run` fires on EVERY conclusion of CI, failures and fork pull
+    # requests included. Only a green push to this repository's own main may
+    # reach production.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'push' &&
+       github.event.workflow_run.head_repository.full_name == github.repository &&
+       github.event.workflow_run.head_branch == 'main')
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout the verified commit
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.DEPLOY_SHA }}
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build the web bundle
+        run: bun run export:web
+
+      - name: Validate the static hosting contract
+        # `_redirects` and `_headers` are copied out of `public/` by the export.
+        # If either goes missing the deploy is still green — and every deep link
+        # 404s, or every visitor keeps a stale bundle. Fail here instead.
+        run: |
+          set -euo pipefail
+          for file in dist/index.html dist/_redirects dist/_headers; do
+            if [[ ! -s "$file" ]]; then
+              echo "::error::$file is missing from the export"
+              exit 1
+            fi
+          done
+
+      - name: Deploy to Cloudflare Pages
+        uses: cloudflare/wrangler-action@v4
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          packageManager: bun
+          command: pages deploy dist --project-name=fairwallet --branch=main
+
+      - name: Smoke test wallet.fairco.in
+        # Two assertions, because they fail independently: the entry document
+        # must carry the bundle this build just emitted (proves the promotion
+        # landed, not that some older deployment answers), and a route with no
+        # file behind it must return 200 (proves `_redirects` is in force).
+        run: |
+          set -euo pipefail
+          bundle="$(basename dist/_expo/static/js/web/entry-*.js)"
+          for attempt in $(seq 1 20); do
+            body="$(curl --fail --silent --show-error https://wallet.fairco.in/ || true)"
+            deep="$(curl --output /dev/null --silent --write-out '%{http_code}' https://wallet.fairco.in/pockets || true)"
+            if [[ "$body" == *"$bundle"* && "$deep" == "200" ]]; then
+              echo "wallet.fairco.in serves $bundle and rewrites deep links."
+              exit 0
+            fi
+            if [[ "$attempt" -eq 20 ]]; then
+              echo "::error::wallet.fairco.in did not converge on $bundle (deep link: $deep)."
+              exit 1
+            fi
+            sleep 15
+          done

public/_headers

@@ -0,0 +1,11 @@
+# Metro fingerprints every bundle and asset it emits under /_expo/static, so
+# those URLs are immutable: a new build is a new path and can never be served
+# from a stale cache entry.
+/_expo/static/*
+  Cache-Control: public, max-age=31536000, immutable
+
+# The entry document is the one file whose URL never changes, so it must be
+# revalidated on every load — otherwise a browser keeps pointing at the bundle
+# hashes of a previous deploy.
+/index.html
+  Cache-Control: public, max-age=0, must-revalidate

public/_redirects

@@ -0,0 +1,6 @@
+# Expo Router exports this app with `web.output: "single"` — one index.html and
+# client-side routing for every path. Cloudflare Pages serves static files and
+# 404s anything without one, so a deep link (/pockets, /transaction/<txid>) or a
+# reload away from "/" would 404 without this rewrite. 200, not 301: the URL the
+# router reads must stay the one the user asked for.
+/*  /index.html  200