preview.yml

name: Preview

on:
  repository_dispatch:
    types: [preview-deploy]
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    branches: ['env/**']

permissions:
  contents: write
  pull-requests: write
  statuses: write

concurrency:
  group: preview-${{ github.event.client_payload.ref || github.head_ref || github.ref_name }}
  cancel-in-progress: true

jobs:
  preview:
    runs-on: ubuntu-latest
    env:
      HAS_CF_SECRETS: ${{ secrets.CLOUDFLARE_API_TOKEN != '' && secrets.CLOUDFLARE_ACCOUNT_ID != '' }}
    steps:
      - name: Resolve ref
        id: resolve
        run: |
          if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
            echo "ref=${{ github.event.client_payload.ref }}" >> "$GITHUB_OUTPUT"
          else
            echo "ref=${{ github.head_ref || github.ref_name }}" >> "$GITHUB_OUTPUT"
          fi

      - uses: actions/checkout@v4
        with:
          ref: ${{ steps.resolve.outputs.ref }}

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Compute preview alias
        id: alias
        run: |
          REF="${{ steps.resolve.outputs.ref }}"
          if echo "$REF" | grep -q '^env/'; then
            ALIAS=$(echo "$REF" | sed 's|^env/||')
          elif [ "${{ github.event_name }}" = "pull_request" ]; then
            ALIAS="pr-${{ github.event.pull_request.number }}"
          else
            ALIAS=$(echo "$REF" | sed 's|[^a-z0-9-]|-|g')
          fi
          echo "alias=$ALIAS" >> "$GITHUB_OUTPUT"

      - name: Install dependencies
        run: npm install

      - name: Build
        run: npm run build

      - name: Upload preview version
        id: deploy
        if: env.HAS_CF_SECRETS == 'true'
        run: |
          set +e
          OUTPUT=$(npx wrangler versions upload --preview-alias ${{ steps.alias.outputs.alias }} 2>&1)
          EXIT_CODE=$?
          set -e
          echo "$OUTPUT"
          if [ $EXIT_CODE -ne 0 ]; then
            echo "::error::wrangler versions upload failed with exit code $EXIT_CODE"
            exit $EXIT_CODE
          fi
          PREVIEW_URL=$(echo "$OUTPUT" | grep 'Version Preview URL:' | sed 's/.*Version Preview URL: //')
          ALIAS_URL=$(echo "$OUTPUT" | grep 'Version Preview Alias URL:' | sed 's/.*Version Preview Alias URL: //')
          echo "preview_url=${PREVIEW_URL}" >> "$GITHUB_OUTPUT"
          echo "alias_url=${ALIAS_URL}" >> "$GITHUB_OUTPUT"
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      - name: Comment preview URL on PR
        if: github.event_name == 'pull_request' && env.HAS_CF_SECRETS == 'true'
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          header: preview-url
          message: |
            ### Preview deployed

            | | URL |
            |---|---|
            | **Version** | ${{ steps.deploy.outputs.preview_url }} |
            | **Alias** | ${{ steps.deploy.outputs.alias_url }} |

      - name: Comment missing-secrets notice on PR
        if: github.event_name == 'pull_request' && env.HAS_CF_SECRETS != 'true'
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          header: preview-url
          message: |
            ### Preview skipped

            Cloudflare secrets are not configured for this repo. Previews are disabled until an admin sets them.

            **To enable:** Settings → Secrets and variables → Actions, add:
            - `CLOUDFLARE_API_TOKEN` — token with `Workers Scripts:Edit` permission
            - `CLOUDFLARE_ACCOUNT_ID` — target Cloudflare account ID

            The build itself passed, so this PR's code is still validated.