mirror of
https://github.com/hanzo-docs/docs.git
synced 2026-10-29 07:01:44 +00:00
zooqueen
784f339af7
With the swap step gone the build runs and succeeds in 60s, and the job now dies in wrangler's deploy: dev-docs has no Cloudflare Pages project, and `pages deploy --project-name` does not make one. The seven sibling deploys that are green each create theirs first, guarded by continue-on-error so an existing project is not an error. This file carried that step too until the move to KMS credentials dropped it.
88 lines
3.5 KiB
YAML
88 lines
3.5 KiB
YAML
name: Deploy Dev Docs
|
|
|
|
on:
|
|
push:
|
|
branches: [main, dev]
|
|
paths:
|
|
- 'apps/dev-docs/**'
|
|
- 'packages/**'
|
|
- 'pnpm-lock.yaml'
|
|
- '.hanzo/workflows/deploy-dev-docs.yml'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: hanzo-docs-build-linux-amd64
|
|
permissions:
|
|
contents: read
|
|
deployments: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: pnpm/action-setup@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
- uses: oven-sh/setup-bun@v2
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build dev-docs
|
|
run: pnpm build --filter=dev-docs
|
|
env:
|
|
NODE_OPTIONS: '--max-old-space-size=8192'
|
|
timeout-minutes: 30
|
|
|
|
- name: Fetch CF credentials from KMS
|
|
id: kms
|
|
env:
|
|
KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
|
|
KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
|
|
KMS_ENDPOINT: ${{ vars.KMS_ENDPOINT || 'https://kms.hanzo.ai' }}
|
|
KMS_SECRET_ENV: ${{ vars.KMS_SECRET_ENV || 'prod' }}
|
|
run: |
|
|
# Canonical Hanzo KMS (/v1/kms): machine-identity login -> bearer,
|
|
# then read CF Pages deploy creds from deploy/<NAME>.
|
|
#
|
|
# FLAT path, and the org rides on the TOKEN. The older
|
|
# /v1/kms/orgs/<org>/secrets/... form is answered by a DIFFERENT
|
|
# instance whose copy is stale, and it nests the value under
|
|
# .secret.value -- so this step read the wrong service and failed
|
|
# closed. deploy.yml in this repo has always used the flat form.
|
|
# Replaces the decommissioned Infisical /api routes (forwards-only).
|
|
token=$(curl -fsS "${KMS_ENDPOINT}/v1/kms/auth/login" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" \
|
|
| jq -r '.accessToken // empty')
|
|
if [ -z "${token}" ]; then
|
|
echo "::error::KMS login failed at ${KMS_ENDPOINT}/v1/kms/auth/login (check KMS_CLIENT_ID/KMS_CLIENT_SECRET)."
|
|
exit 1
|
|
fi
|
|
kms_get() {
|
|
curl -fsS "${KMS_ENDPOINT}/v1/kms/secrets/deploy/$1?env=${KMS_SECRET_ENV}" \
|
|
-H "Authorization: Bearer ${token}" | jq -r '.value // empty'
|
|
}
|
|
cf_token=$(kms_get CLOUDFLARE_API_TOKEN)
|
|
cf_account=$(kms_get CLOUDFLARE_ACCOUNT_ID)
|
|
if [ -z "${cf_token}" ] || [ -z "${cf_account}" ]; then
|
|
echo "::error::No CLOUDFLARE_API_TOKEN/CLOUDFLARE_ACCOUNT_ID at ${KMS_ENDPOINT}/v1/kms/secrets/deploy (env ${KMS_SECRET_ENV})."
|
|
exit 1
|
|
fi
|
|
echo "::add-mask::${cf_token}"
|
|
echo "::add-mask::${cf_account}"
|
|
echo "cf_token=${cf_token}" >> "$GITHUB_OUTPUT"
|
|
echo "cf_account=${cf_account}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Create Cloudflare Pages project (if needed)
|
|
continue-on-error: true
|
|
run: npx wrangler pages project create dev-docs --production-branch=main
|
|
env:
|
|
CLOUDFLARE_API_TOKEN: ${{ steps.kms.outputs.cf_token }}
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ steps.kms.outputs.cf_account }}
|
|
|
|
- name: Deploy to Cloudflare Pages
|
|
working-directory: apps/dev-docs
|
|
run: pnpm dlx wrangler pages deploy out --project-name=dev-docs --commit-dirty=true
|
|
env:
|
|
CLOUDFLARE_API_TOKEN: ${{ steps.kms.outputs.cf_token }}
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ steps.kms.outputs.cf_account }}
|