refresh-marketing.yml

name: Refresh marketing site

# Calls the marketing site's on-demand ISR revalidation endpoint so
# helmor.ai reflects a new version within seconds of a release going live,
# instead of waiting for the 3600s ISR window in `apps/marketing/lib/github.ts`.
#
# Triggered on `release.published` for manual releases or a draft being
# published outside publish.yml. Releases created by a workflow with
# `GITHUB_TOKEN` do not trigger this workflow, so publish.yml also performs
# a direct revalidation after a non-draft release completes.
#
# `workflow_dispatch` is kept for first-time verification and manual recovery.
#
# Failure mode: if this workflow fails, the 3600s ISR fallback still works --
# helmor.ai is at worst ~1 hour stale, never broken.

on:
  release:
    types: [published]
  workflow_dispatch:

concurrency:
  group: refresh-marketing
  cancel-in-progress: false

jobs:
  revalidate:
    # Skip prereleases (marketing site only tracks stable latest). `workflow_dispatch`
    # has no release payload, so this condition must allow it through.
    if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: Call revalidate endpoint
        env:
          SECRET: ${{ secrets.HELMOR_MARKETING_REVALIDATE_SECRET }}
        # curl --fail makes non-2xx return an exit code; --retry handles
        # transient Vercel cold starts. The secret is passed via env and
        # injected into a header (never argv or URL) to keep it out of
        # process listings and access logs.
        run: |
          if [ -z "${SECRET}" ]; then
            echo "HELMOR_MARKETING_REVALIDATE_SECRET is not set"
            exit 1
          fi
          curl --fail --silent --show-error \
            --retry 3 --retry-delay 10 --retry-connrefused \
            -X POST "https://helmor.ai/api/revalidate" \
            -H "x-revalidate-secret: ${SECRET}" \
            -H "content-type: application/json"