name: Delivery

on:
  workflow_run:
    workflows: ["Main Gate"]
    types: [completed]
    branches: [main]

concurrency:
  group: delivery-main
  cancel-in-progress: false

permissions: {}

jobs:
  release:
    name: Release packages
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: [self-hosted, linux, x64, platform-gate]
    timeout-minutes: 60
    permissions:
      actions: write
      contents: write
      pull-requests: write
      packages: write
    env:
      TESTED_SHA: ${{ github.event.workflow_run.head_sha }}
    steps:
      - name: Checkout tested commit
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
      - name: Verify tested commit
        run: test "$(git rev-parse HEAD)" = "$TESTED_SHA"
      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 26
      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
        with:
          # The default ~/setup-pnpm is shared by every runner on the box, so a
          # concurrent job replaces the pnpm binary turbo is mid-spawn on.
          dest: ${{ runner.temp }}/setup-pnpm
      - name: Install
        # pnpm derives its store from PNPM_HOME, which now lives in the
        # per-job _temp dir — without this the store is wiped every run.
        run: pnpm install --frozen-lockfile --store-dir "$RUNNER_TOOL_CACHE/pnpm-store"
      - name: Build publishable artifacts
        run: pnpm build
      - name: Configure GitHub Packages
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 26
          registry-url: https://npm.pkg.github.com
          scope: "@platform-modules"
      - name: Create release PR or publish
        id: changesets
        uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          version-script: pnpm changeset:version
          publish-script: env NPM_CONFIG_REGISTRY=https://npm.pkg.github.com npm_config_registry=https://npm.pkg.github.com pnpm exec changeset publish
          commit-message: "chore(release): version packages"
          pr-title: "chore(release): version packages"
          create-github-releases: true
          push-git-tags: true
          # Preserve the repository's existing annotated package-tag objects.
          # v2's API push mode creates refs directly at the commit; Git CLI pushes
          # the annotated tags emitted by `changeset publish`.
          push-with-git-cli: true
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          LEFTHOOK: 0
      - name: Approve generated release PR gate
        if: steps.changesets.outputs['pr-number'] != ''
        run: node scripts/approve-changeset-release-pr.mjs
        env:
          GITHUB_TOKEN: ${{ github.token }}
          RELEASE_PR_NUMBER: ${{ steps.changesets.outputs['pr-number'] }}
      - name: Verify release tags
        run: node scripts/verify-release-tags.mjs

  deploy-mod-cms:
    name: Deploy mod-cms
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: [self-hosted, linux, x64, platform-gate]
    timeout-minutes: 60
    environment: production
    permissions:
      contents: read
    env:
      TESTED_SHA: ${{ github.event.workflow_run.head_sha }}
    steps:
      - name: Checkout tested commit
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
      - name: Verify tested commit
        run: test "$(git rev-parse HEAD)" = "$TESTED_SHA"
      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 26
      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
        with:
          # The default ~/setup-pnpm is shared by every runner on the box, so a
          # concurrent job replaces the pnpm binary turbo is mid-spawn on.
          dest: ${{ runner.temp }}/setup-pnpm
      - name: Install
        # pnpm derives its store from PNPM_HOME, which now lives in the
        # per-job _temp dir — without this the store is wiped every run.
        run: pnpm install --frozen-lockfile --store-dir "$RUNNER_TOOL_CACHE/pnpm-store"
      - name: Build production Worker
        run: pnpm --filter @app/mod-cms... build
      - name: Apply production D1 migrations
        run: pnpm --filter @app/mod-cms exec wrangler d1 migrations apply DB --remote
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
      - name: Deploy production Worker
        run: pnpm --filter @app/mod-cms exec wrangler deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
      - name: Arm scheduled publishing
        run: pnpm --filter @app/mod-cms exec node scripts/arm-after-deploy.mjs
        env:
          CRON_DO_SECRET: ${{ secrets.CRON_DO_SECRET }}
          MOD_CMS_ARM_URL: ${{ secrets.MOD_CMS_ARM_URL }}
