merge: add/liquid-docs (aggressive theirs)

.github/workflows/deploy-liquid-docs.yml

@@ -0,0 +1,148 @@
+name: Deploy Liquid Docs
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - 'apps/liquid/**'
+      - 'packages/**'
+      - 'pnpm-lock.yaml'
+      - '.github/workflows/deploy-liquid-docs.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+  deployments: write
+
+jobs:
+  build:
+    runs-on: hanzo-deploy-linux-amd64
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - uses: oven-sh/setup-bun@v2
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build --filter=liquid-docs
+        env:
+          NODE_OPTIONS: '--max-old-space-size=8192'
+          NEXT_PUBLIC_SITE_URL: 'https://liquid.lux.network'
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: liquid-docs-out
+          path: apps/liquid/out
+
+  image:
+    needs: build
+    if: github.ref == 'refs/heads/main'
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            arch: amd64
+          - runner: ubuntu-24.04-arm
+            arch: arm64
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: liquid-docs-out
+          path: apps/liquid/out
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v6
+        with:
+          context: apps/liquid
+          file: apps/liquid/Dockerfile
+          platforms: linux/${{ matrix.arch }}
+          push: true
+          tags: |
+            ghcr.io/hanzoai/liquid-docs:${{ github.sha }}-${{ matrix.arch }}
+            ghcr.io/hanzoai/liquid-docs:latest-${{ matrix.arch }}
+          cache-from: type=gha,scope=liquid-docs-${{ matrix.arch }}
+          cache-to: type=gha,scope=liquid-docs-${{ matrix.arch }},mode=max
+
+  manifest:
+    needs: image
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - run: |
+          for tag in "${{ github.sha }}" latest; do
+            docker buildx imagetools create \
+              -t ghcr.io/hanzoai/liquid-docs:$tag \
+              ghcr.io/hanzoai/liquid-docs:$tag-amd64 \
+              ghcr.io/hanzoai/liquid-docs:$tag-arm64
+          done
+
+  # Cloudflare Pages deploy: requires CLOUDFLARE_API_TOKEN/ACCOUNT_ID at
+  # KMS workspaceId=e1359bf4-31b4-4dfa-bb90-323e2c298ad8 secretPath=/deploy
+  # Re-enable with `if: github.ref == 'refs/heads/main'` once KMS is populated.
+  cloudflare:
+    needs: build
+    if: false  # disabled until KMS has CF creds (also blocks bot-docs/zen-docs)
+    runs-on: hanzo-deploy-linux-amd64
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: liquid-docs-out
+          path: apps/liquid/out
+      - name: Fetch CF credentials from KMS
+        id: kms
+        env:
+          KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
+          KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
+          HANZO_API_KEY: ${{ secrets.HANZO_API_KEY }}
+          KMS_ENDPOINT: ${{ vars.KMS_ENDPOINT || 'https://kms.hanzo.ai' }}
+        run: |
+          if [ -n "${KMS_CLIENT_ID}" ] && [ -n "${KMS_CLIENT_SECRET}" ]; then
+            HANZO_API_KEY=$(curl -sf "${KMS_ENDPOINT}/api/v1/auth/universal-auth/login" \
+              -H "Content-Type: application/json" \
+              -d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" | jq -r '.accessToken')
+          fi
+          response=$(curl -sf "${KMS_ENDPOINT}/api/v3/secrets/raw?workspaceId=e1359bf4-31b4-4dfa-bb90-323e2c298ad8&secretPath=/deploy&environment=prod" \
+            -H "Authorization: Bearer ${HANZO_API_KEY}" 2>/dev/null || echo "")
+          if [ -n "$response" ]; then
+            cf_token=$(echo "$response" | jq -r '.secrets[] | select(.secretKey=="CLOUDFLARE_API_TOKEN") | .secretValue // empty')
+            cf_account=$(echo "$response" | jq -r '.secrets[] | select(.secretKey=="CLOUDFLARE_ACCOUNT_ID") | .secretValue // empty')
+          fi
+          if [ -z "${cf_token:-}" ]; then
+            echo "::error::CF credentials not found in KMS."
+            exit 1
+          fi
+          echo "::add-mask::${cf_token}"
+          echo "::add-mask::${cf_account}"
+          echo "cf_token=${cf_token}" >> "$GITHUB_OUTPUT"
+          echo "cf_account=${cf_account}" >> "$GITHUB_OUTPUT"
+
+      - name: Create Cloudflare Pages project (if needed)
+        continue-on-error: true
+        run: npx wrangler pages project create liquid-docs --production-branch=main
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ steps.kms.outputs.cf_token }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ steps.kms.outputs.cf_account }}
+
+      - name: Deploy to Cloudflare Pages
+        run: npx wrangler pages deploy apps/liquid/out --project-name=liquid-docs --commit-dirty=true
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ steps.kms.outputs.cf_token }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ steps.kms.outputs.cf_account }}