fix(workbench): revoke hosts from relay #22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Cloudflare | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: cloudflare-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| ACP_RUNTIME_REPO_URL: https://github.com/saaskit-dev/acp-runtime.git | |
| EXPO_PUBLIC_RELAY_URL: https://free-relay.saaskit.app | |
| EXPO_PUBLIC_WORKBENCH_ORIGIN: https://free.saaskit.app | |
| RELAY_DOMAIN: free-relay.saaskit.app | |
| WORKBENCH_PAGES_PROJECT: free-app | |
| BUN_VERSION: 1.3.14 | |
| jobs: | |
| verify: | |
| name: Verify | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Free | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Set up Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Set up Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - name: Clone pinned acp-runtime | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| ACP_RUNTIME_REF="$(sed -e 's/[[:space:]]*$//' -e '/^$/d' .acp-runtime-ref | head -n 1)" | |
| if [ -z "$ACP_RUNTIME_REF" ]; then | |
| echo "Missing pinned acp-runtime ref in .acp-runtime-ref" >&2 | |
| exit 1 | |
| fi | |
| rm -rf ../acp-runtime | |
| git init ../acp-runtime | |
| git -C ../acp-runtime remote add origin "$ACP_RUNTIME_REPO_URL" | |
| git -C ../acp-runtime fetch --depth 1 origin "$ACP_RUNTIME_REF" | |
| git -C ../acp-runtime checkout --detach FETCH_HEAD | |
| - name: Install pinned acp-runtime dependencies | |
| run: cd ../acp-runtime && bun install --frozen-lockfile | |
| - name: Build pinned acp-runtime | |
| run: | | |
| cd ../acp-runtime | |
| bun run --cwd packages/simulator-agent build | |
| bun run build:lib | |
| - name: Install Free dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Verify Free | |
| run: | | |
| make typecheck | |
| bun run --cwd apps/workbench typecheck | |
| make test | |
| make pack-local | |
| make package-install-check | |
| make source-install-smoke | |
| deploy-relay: | |
| name: Deploy Relay Worker | |
| runs-on: ${{ fromJSON(vars.MACOS_RUNNER_LABELS_JSON || vars.IOS_RUNNER_LABELS_JSON || '["self-hosted","macOS","ARM64","local-mac"]') }} | |
| needs: verify | |
| if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main' | |
| environment: | |
| name: production | |
| url: https://free-relay.saaskit.app | |
| env: | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| steps: | |
| - name: Checkout Free | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Set up Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Set up Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - name: Clone pinned acp-runtime | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| ACP_RUNTIME_REF="$(sed -e 's/[[:space:]]*$//' -e '/^$/d' .acp-runtime-ref | head -n 1)" | |
| if [ -z "$ACP_RUNTIME_REF" ]; then | |
| echo "Missing pinned acp-runtime ref in .acp-runtime-ref" >&2 | |
| exit 1 | |
| fi | |
| rm -rf ../acp-runtime | |
| git init ../acp-runtime | |
| git -C ../acp-runtime remote add origin "$ACP_RUNTIME_REPO_URL" | |
| git -C ../acp-runtime fetch --depth 1 origin "$ACP_RUNTIME_REF" | |
| git -C ../acp-runtime checkout --detach FETCH_HEAD | |
| - name: Install pinned acp-runtime dependencies | |
| run: cd ../acp-runtime && bun install --frozen-lockfile | |
| - name: Build pinned acp-runtime | |
| run: | | |
| cd ../acp-runtime | |
| bun run --cwd packages/simulator-agent build | |
| bun run build:lib | |
| - name: Install Free dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Deploy relay | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| scripts/retry-network.sh make relay-migrate-remote | |
| scripts/retry-network.sh make relay-deploy-dry-run | |
| scripts/retry-network.sh bash -lc 'cd relay && bunx wrangler deploy --domain "$RELAY_DOMAIN"' | |
| deploy-workbench: | |
| name: Deploy Workbench Pages | |
| runs-on: ${{ fromJSON(vars.MACOS_RUNNER_LABELS_JSON || vars.IOS_RUNNER_LABELS_JSON || '["self-hosted","macOS","ARM64","local-mac"]') }} | |
| needs: deploy-relay | |
| if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main' | |
| environment: | |
| name: production | |
| url: https://free.saaskit.app | |
| env: | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| steps: | |
| - name: Checkout Free | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Set up Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Set up Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: ${{ env.BUN_VERSION }} | |
| - name: Clone pinned acp-runtime | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| ACP_RUNTIME_REF="$(sed -e 's/[[:space:]]*$//' -e '/^$/d' .acp-runtime-ref | head -n 1)" | |
| if [ -z "$ACP_RUNTIME_REF" ]; then | |
| echo "Missing pinned acp-runtime ref in .acp-runtime-ref" >&2 | |
| exit 1 | |
| fi | |
| rm -rf ../acp-runtime | |
| git init ../acp-runtime | |
| git -C ../acp-runtime remote add origin "$ACP_RUNTIME_REPO_URL" | |
| git -C ../acp-runtime fetch --depth 1 origin "$ACP_RUNTIME_REF" | |
| git -C ../acp-runtime checkout --detach FETCH_HEAD | |
| - name: Install pinned acp-runtime dependencies | |
| run: cd ../acp-runtime && bun install --frozen-lockfile | |
| - name: Build pinned acp-runtime | |
| run: | | |
| cd ../acp-runtime | |
| bun run --cwd packages/simulator-agent build | |
| bun run build:lib | |
| - name: Install Free dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Deploy Workbench | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| bun run --cwd apps/workbench typecheck | |
| make workbench-export | |
| scripts/retry-network.sh bash -lc 'cd relay && bunx wrangler pages deploy ../apps/workbench/dist --project-name "${WORKBENCH_PAGES_PROJECT:-free-app}" --commit-dirty=true --commit-message "deploy $(git rev-parse --short HEAD 2>/dev/null || printf manual)"' |