name: Delivery

on:
  workflow_run:
    workflows: ["Main Gate"]
    types: [completed]
    branches: [main]

concurrency:
  group: delivery-main
  cancel-in-progress: false

permissions: {}

jobs:
  release:
    name: Release packages
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: [self-hosted, linux, x64, platform-gate]
    timeout-minutes: 60
    permissions:
      contents: write
      pull-requests: write
      packages: write
    env:
      TESTED_SHA: ${{ github.event.workflow_run.head_sha }}
    steps:
      - name: Checkout tested commit
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
      - name: Verify tested commit
        run: test "$(git rev-parse HEAD)" = "$TESTED_SHA"
      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm
      - name: Install
        run: pnpm install --frozen-lockfile
      - name: Build publishable artifacts
        run: pnpm build
      - name: Configure GitHub Packages
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          registry-url: https://npm.pkg.github.com
          scope: "@platform-modules"
      - name: Create release PR or publish
        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1
        with:
          version: pnpm changeset:version
          publish: pnpm exec changeset publish
          commit: "chore(release): version packages"
          title: "chore(release): version packages"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          LEFTHOOK: 0

  deploy-mod-cms:
    name: Deploy mod-cms
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: [self-hosted, linux, x64, platform-gate]
    timeout-minutes: 60
    environment: production
    permissions:
      contents: read
    env:
      TESTED_SHA: ${{ github.event.workflow_run.head_sha }}
    steps:
      - name: Checkout tested commit
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
      - name: Verify tested commit
        run: test "$(git rev-parse HEAD)" = "$TESTED_SHA"
      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm
      - name: Install
        run: pnpm install --frozen-lockfile
      - name: Build production Worker
        run: pnpm build
      - name: Deploy production Worker
        run: pnpm --filter @app/mod-cms exec wrangler deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
      - name: Arm scheduled publishing
        run: pnpm --filter @app/mod-cms exec node scripts/arm-after-deploy.mjs
        env:
          CRON_DO_SECRET: ${{ secrets.CRON_DO_SECRET }}
          MOD_CMS_ARM_URL: ${{ secrets.MOD_CMS_ARM_URL }}
