deploy.yml

name: Deploy on Polkadot

on:
  workflow_call:
    inputs:
      basename:
        description: 'Base domain without .dot'
        required: true
        type: string

      mode:
        description: 'preview (subname deploy) | production (basename deploy)'
        required: false
        type: string
        default: 'preview'

      subname-format:
        description: 'pr-number | branch | sha-short (ignored in production mode)'
        required: false
        type: string
        default: 'pr-number'

      subname:
        description: 'Explicit subname override for preview deployments'
        required: false
        type: string
        default: ''

      register-base:
        description: 'Attempt base domain registration if not already owned'
        required: false
        type: boolean
        default: false

      artifact-name:
        description: 'Build artifact to deploy'
        required: true
        type: string

      cli-source:
        description: 'CLI install source: release or source'
        required: false
        type: string
        default: 'release'

      sdk-ref:
        description: 'dotns-sdk ref used for checked out composite actions and source builds'
        required: false
        type: string
        default: 'main'

      sdk-repository:
        description: 'Repository used for checked out composite actions and source builds'
        required: false
        type: string
        default: 'paritytech/dotns-sdk'

      use-car:
        description: 'Merkleize with IPFS CLI and upload as a single CAR file'
        required: false
        type: boolean
        default: true

      key-uri:
        description: 'Substrate key URI for dev/test (e.g., //Alice)'
        required: false
        type: string

      bulletin-rpc:
        description: 'Bulletin chain WebSocket RPC endpoint (default: CLI built-in)'
        required: false
        type: string

      rpc:
        description: 'WebSocket RPC endpoint (default: CLI built-in)'
        required: false
        type: string

      env:
        description: 'DotNS environment'
        required: false
        type: string
        default: 'paseo-v2'

      upload-concurrency:
        description: 'Adaptive scheduler max window (max: 4)'
        required: false
        type: number
        default: 4

      skip-cache:
        description: 'Skip deployment cache and force re-upload'
        required: false
        type: boolean
        default: false

      cache:
        description: 'Write uploaded CID to on-chain Store after upload'
        required: false
        type: boolean
        default: false

      max-retries:
        description: 'Max retry attempts per step for transient RPC failures'
        required: false
        type: number
        default: 3

      retry-delay:
        description: 'Seconds to wait between retries'
        required: false
        type: number
        default: 15

    secrets:
      dotns-mnemonic:
        description: 'BIP39 mnemonic for DotNS on-chain operations (register, contenthash)'
        required: true

      bulletin-mnemonic:
        description: 'BIP39 mnemonic for Bulletin uploads (defaults to //Alice dev seed)'
        required: false

    outputs:
      cid:
        value: ${{ jobs.deploy.outputs.cid }}
      fqdn:
        value: ${{ jobs.deploy.outputs.fqdn }}
      url:
        value: ${{ jobs.deploy.outputs.url }}
      url-alt:
        value: ${{ jobs.deploy.outputs.url-alt }}
      url-direct:
        value: ${{ jobs.deploy.outputs.url-direct }}
      url-dotli-path:
        value: ${{ jobs.deploy.outputs.url-dotli-path }}
      url-dotli-host:
        value: ${{ jobs.deploy.outputs.url-dotli-host }}
      cache-hit:
        value: ${{ jobs.deploy.outputs.cache-hit }}
      duration-seconds:
        value: ${{ jobs.deploy.outputs.duration-seconds }}

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    outputs:
      cid: ${{ steps.final.outputs.cid }}
      fqdn: ${{ steps.final.outputs.fqdn }}
      url: ${{ steps.final.outputs.url }}
      url-alt: ${{ steps.final.outputs.url-alt }}
      url-direct: ${{ steps.final.outputs.url-direct }}
      url-dotli-path: ${{ steps.final.outputs.url-dotli-path }}
      url-dotli-host: ${{ steps.final.outputs.url-dotli-host }}
      cache-hit: ${{ steps.cache.outputs.cache-hit }}
      duration-seconds: ${{ steps.duration.outputs.seconds }}

    steps:
      - name: Checkout actions
        uses: actions/checkout@v4
        with:
          repository: ${{ inputs.sdk-repository }}
          ref: ${{ inputs.sdk-ref }}
          sparse-checkout: |
            .github/actions
            packages/cli
            packages/ui/package.json
            packages/ui/.papi
            package.json
            bun.lock

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Download build artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.artifact-name }}
          path: build

      - name: Setup CLI
        uses: ./.github/actions/setup-cli
        with:
          source: ${{ inputs.cli-source }}

      - name: Record deploy start
        id: timer-start
        run: echo "epoch=$(date +%s)" >> "$GITHUB_OUTPUT"

      - name: Resolve target
        id: target
        run: |
          if [[ "$MODE" == "production" ]]; then
            echo "domain=$BASENAME" >> "$GITHUB_OUTPUT"
            echo "fqdn=${BASENAME}.dot" >> "$GITHUB_OUTPUT"
          else
            if [[ -n "$SUBNAME_OVERRIDE" ]]; then
              SUBNAME="$SUBNAME_OVERRIDE"
            else
              case "$SUBNAME_FORMAT" in
                pr-number)
                  SUBNAME="pr${PR_NUMBER}"
                  ;;
                branch)
                  SUBNAME=$(echo "$HEAD_REF" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | cut -c1-20 | sed 's/-$//')
                  ;;
                sha-short)
                  SUBNAME=$(echo "$COMMIT_SHA" | cut -c1-7)
                  ;;
              esac
            fi

            echo "subname=$SUBNAME" >> "$GITHUB_OUTPUT"
            echo "domain=${SUBNAME}.${BASENAME}" >> "$GITHUB_OUTPUT"
            echo "fqdn=${SUBNAME}.${BASENAME}.dot" >> "$GITHUB_OUTPUT"
          fi
        env:
          MODE: ${{ inputs.mode }}
          BASENAME: ${{ inputs.basename }}
          SUBNAME_FORMAT: ${{ inputs.subname-format }}
          SUBNAME_OVERRIDE: ${{ inputs.subname }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          HEAD_REF: ${{ github.head_ref }}
          COMMIT_SHA: ${{ github.sha }}

      - name: Compute build hash
        id: hash
        run: |
          HASH=$(find build -type f -exec sha256sum {} \; | sort | sha256sum | cut -d' ' -f1)
          echo "hash=$HASH" >> "$GITHUB_OUTPUT"
          echo "Build hash: $HASH"

      - name: Check deployment cache
        id: cache
        if: inputs.skip-cache != true
        uses: actions/cache@v4
        with:
          path: .deploy-cache
          key: deploy-${{ steps.hash.outputs.hash }}

      - name: Load cached CID
        id: cached
        if: steps.cache.outputs.cache-hit == 'true'
        run: |
          CID=$(cat .deploy-cache/cid)
          echo "cid=$CID" >> "$GITHUB_OUTPUT"
          echo "::notice::Cache hit — reusing CID: $CID"

      - name: Resolve upload settings
        id: upload-settings
        if: steps.cache.outputs.cache-hit != 'true'
        shell: bash
        run: |
          EFFECTIVE_UPLOAD_CONCURRENCY="$UPLOAD_CONCURRENCY"
          if [[ "$MODE" == "preview" && "$EFFECTIVE_UPLOAD_CONCURRENCY" -gt 10 ]]; then
            EFFECTIVE_UPLOAD_CONCURRENCY=10
          fi
          echo "upload-concurrency=$EFFECTIVE_UPLOAD_CONCURRENCY" >> "$GITHUB_OUTPUT"
        env:
          MODE: ${{ inputs.mode }}
          UPLOAD_CONCURRENCY: ${{ inputs.upload-concurrency }}

      - name: Export CAR file
        id: car
        if: steps.cache.outputs.cache-hit != 'true' && inputs.use-car
        shell: bash
        run: |
          # Install IPFS Kubo if not already available
          if ! command -v ipfs &>/dev/null; then
            echo "Installing IPFS Kubo..."
            wget -qO- https://dist.ipfs.tech/kubo/v0.33.2/kubo_v0.33.2_linux-amd64.tar.gz | tar xz
            sudo mv kubo/ipfs /usr/local/bin/
            rm -rf kubo
          fi

          ipfs init --profile server 2>/dev/null || true

          CID=$(ipfs add -Q -r --cid-version=1 --raw-leaves --pin=false ./build)
          ipfs dag export "$CID" > build.car
          SIZE=$(stat --printf='%s' build.car)

          echo "ipfs-cid=$CID" >> "$GITHUB_OUTPUT"
          echo "::notice::CAR file created: $(numfmt --to=iec $SIZE) — IPFS CID: $CID"

      - name: Upload to Bulletin
        id: bulletin
        if: steps.cache.outputs.cache-hit != 'true'
        uses: ./.github/actions/bulletin
        with:
          mnemonic: ${{ secrets.bulletin-mnemonic || 'bottom drive obey lake curtain smoke basket hold race lonely fit walk' }}
          env: ${{ inputs.env }}
          bulletin-rpc: ${{ inputs.bulletin-rpc }}
          build-path: ${{ inputs.use-car && './build.car' || './build' }}
          upload-concurrency: ${{ steps.upload-settings.outputs.upload-concurrency }}
          max-retries: ${{ inputs.max-retries }}
          retry-delay: ${{ inputs.retry-delay }}
          cache: ${{ inputs.cache }}

      - name: Save CID to cache
        if: steps.cache.outputs.cache-hit != 'true' && steps.bulletin.outputs.cid != ''
        run: |
          mkdir -p .deploy-cache
          echo "$CID" > .deploy-cache/cid
        env:
          CID: ${{ steps.bulletin.outputs.cid }}

      - name: Resolve CID
        id: cid
        run: |
          CID="${CACHED_CID:-$UPLOAD_CID}"

          if [[ -z "$CID" ]]; then
            echo "::error::No CID available from cache or upload"
            exit 1
          fi

          echo "cid=$CID" >> "$GITHUB_OUTPUT"
        env:
          CACHED_CID: ${{ steps.cached.outputs.cid }}
          UPLOAD_CID: ${{ steps.bulletin.outputs.cid }}

      - name: Register and set contenthash
        uses: ./.github/actions/dotns
        with:
          mnemonic: ${{ secrets.dotns-mnemonic }}
          env: ${{ inputs.env }}
          rpc: ${{ inputs.rpc }}
          basename: ${{ inputs.basename }}
          mode: ${{ inputs.mode }}
          subname: ${{ steps.target.outputs.subname }}
          domain: ${{ steps.target.outputs.domain }}
          register-base: ${{ inputs.register-base }}
          cid: ${{ steps.cid.outputs.cid }}
          max-retries: ${{ inputs.max-retries }}
          retry-delay: ${{ inputs.retry-delay }}

      - name: Set outputs
        id: final
        run: |
          DOTLI_PATH_URL="https://dot.li/${FQDN}"
          DIRECT_URL="https://${FQDN}"
          DOTLI_HOST_URL=""

          if [[ -n "$SUBNAME" ]]; then
            PRIMARY_URL="$DOTLI_PATH_URL"
          else
            DOTLI_HOST_URL="https://${DOMAIN}.dot.li"
            PRIMARY_URL="$DOTLI_HOST_URL"
          fi

          echo "cid=$CID" >> "$GITHUB_OUTPUT"
          echo "fqdn=$FQDN" >> "$GITHUB_OUTPUT"
          echo "url=$PRIMARY_URL" >> "$GITHUB_OUTPUT"
          echo "url-alt=$DIRECT_URL" >> "$GITHUB_OUTPUT"
          echo "url-direct=$DIRECT_URL" >> "$GITHUB_OUTPUT"
          echo "url-dotli-path=$DOTLI_PATH_URL" >> "$GITHUB_OUTPUT"
          echo "url-dotli-host=$DOTLI_HOST_URL" >> "$GITHUB_OUTPUT"
        env:
          CID: ${{ steps.cid.outputs.cid }}
          FQDN: ${{ steps.target.outputs.fqdn }}
          DOMAIN: ${{ steps.target.outputs.domain }}
          SUBNAME: ${{ steps.target.outputs.subname }}

      - name: Compute deploy duration
        id: duration
        run: |
          START="${START_EPOCH}"
          END=$(date +%s)
          ELAPSED=$((END - START))
          echo "seconds=$ELAPSED" >> "$GITHUB_OUTPUT"
        env:
          START_EPOCH: ${{ steps.timer-start.outputs.epoch }}

      - name: Summary
        run: |
          CACHE_NOTE=""
          if [[ "$CACHE_HIT" == "true" ]]; then
            CACHE_NOTE=" (cached)"
          fi

          BULLETIN_AUTH="mnemonic"
          if [[ -z "$BULLETIN_MNEMONIC" ]]; then
            BULLETIN_AUTH="alice"
          fi

          if [[ -n "$SUBNAME" ]]; then
            URL_ROWS=$(cat <<EOF
          | URL (dot.li) | [${URL_DOTLI_PATH}](${URL_DOTLI_PATH}) |
          | URL (direct) | [${URL_DIRECT}](${URL_DIRECT}) |
          EOF
            )
          else
            URL_ROWS="| URL | [${URL_DOTLI_HOST}](${URL_DOTLI_HOST}) |"
          fi

          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
          ## Deployment Complete

          | Property | Value |
          |----------|-------|
          | Mode | \`${MODE}\` |
          | Domain | \`${FQDN}\` |
          | CID | \`${CID}\`${CACHE_NOTE} |
          ${URL_ROWS}
          | Duration | ${DURATION_SECONDS}s |
          | Bulletin Auth | ${BULLETIN_AUTH} |
          EOF
        env:
          MODE: ${{ inputs.mode }}
          FQDN: ${{ steps.final.outputs.fqdn }}
          CID: ${{ steps.final.outputs.cid }}
          URL_DIRECT: ${{ steps.final.outputs.url-direct }}
          URL_DOTLI_PATH: ${{ steps.final.outputs.url-dotli-path }}
          URL_DOTLI_HOST: ${{ steps.final.outputs.url-dotli-host }}
          SUBNAME: ${{ steps.target.outputs.subname }}
          DURATION_SECONDS: ${{ steps.duration.outputs.seconds }}
          BULLETIN_MNEMONIC: ${{ secrets.bulletin-mnemonic }}
          CACHE_HIT: ${{ steps.cache.outputs.cache-hit }}