deploy-web.yml

name: Deploy Website

concurrency: Website Production

on:
  workflow_dispatch:
  repository_dispatch:
    types: [trigger-web-deployment]

jobs:
  check-deploy-conditions:
    runs-on: ubuntu-latest
    outputs:
      should_deploy: ${{ steps.check.outputs.should_deploy }}
    steps:
      - name: Check deployment conditions
        id: check
        run: |
          # Default to deploy
          SHOULD_DEPLOY="true"
          
          # If triggered by repository dispatch, check conditions
          if [[ "${{ github.event_name }}" == "repository_dispatch" ]]; then
            # Parse client payload
            SOURCE="${{ github.event.client_payload.source }}"
            SUCCESS="${{ github.event.client_payload.success }}"
            WEB_CHANGED="${{ github.event.client_payload.web_changed }}"
            
            # Skip deployment if:
            # - Release was unsuccessful AND
            # - No web files were changed
            if [[ "$SUCCESS" == "failure" && "$WEB_CHANGED" != "true" ]]; then
              SHOULD_DEPLOY="false"
              echo "Skipping deployment: Release failed and no web changes detected"
            fi
          fi
          
          echo "should_deploy=$SHOULD_DEPLOY" >> $GITHUB_OUTPUT
          echo "Deployment decision: $SHOULD_DEPLOY"

  run-deploy-job:
    needs: check-deploy-conditions
    if: needs.check-deploy-conditions.outputs.should_deploy != 'false'
    runs-on: ubuntu-latest
    environment: Website Production
    timeout-minutes: 22
    outputs:
      deployment_status: ${{ steps.deploy.outputs.status }}
      
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: "lts/*"

      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: "latest"

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Install dependencies
        run: bun install

      - name: Run security audit
        run: npm audit signatures

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-2
          
      - name: Deploy to production
        id: deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_DEFAULT_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_DEFAULT_ACCOUNT_ID }}
          CLOUDFLARE_EMAIL: ${{ secrets.CLOUDFLARE_EMAIL }}
        run: |
          start_time=$(date +%s)
          bun sst unlock --stage production
          if bun run sst deploy --stage production; then
            status="success"
          else
            status="failure"
          fi
          end_time=$(date +%s)
          duration=$((end_time - start_time))
          echo "status=$status" >> $GITHUB_OUTPUT
          echo "duration=$((duration / 60))m $((duration % 60))s" >> $GITHUB_OUTPUT

      - name: Fail the job if deployment failed
        if: steps.deploy.outputs.status == 'failure'
        run: exit 1