name: Deploy Production

on:
  push:
    branches: [main]

jobs:
  check:
    name: Typecheck + Lint + Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - run: rm .platform
      - uses: actions/checkout@v7
        with:
          repository: platform-modules/mod
          ref: 8ff74af8a1433f0a864e07ec4cd765d412086c0f
          path: .platform
          token: ${{ secrets.PLATFORM_REPO_TOKEN }}

      - uses: pnpm/action-setup@v6
        with:
          version: 10.33.0

      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm

      - name: Install platform dependencies
        working-directory: .platform
        run: corepack pnpm install --config.confirmModulesPurge=false --frozen-lockfile

      - name: Build platform modules
        working-directory: .platform
        run: corepack pnpm run build

      - name: Install dependencies
        run: pnpm install --config.confirmModulesPurge=false --frozen-lockfile

      - name: Typecheck + Lint + Test
        run: pnpm turbo typecheck lint test

  deploy:
    name: Deploy Production
    runs-on: ubuntu-latest
    needs: check
    environment: production
    steps:
      - uses: actions/checkout@v7

      - run: rm .platform
      - uses: actions/checkout@v7
        with:
          repository: platform-modules/mod
          ref: 8ff74af8a1433f0a864e07ec4cd765d412086c0f
          path: .platform
          token: ${{ secrets.PLATFORM_REPO_TOKEN }}

      - uses: pnpm/action-setup@v6
        with:
          version: 10.33.0

      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm

      - name: Install platform dependencies
        working-directory: .platform
        run: corepack pnpm install --config.confirmModulesPurge=false --frozen-lockfile

      - name: Build platform modules
        working-directory: .platform
        run: corepack pnpm run build

      - name: Install dependencies
        run: pnpm install --config.confirmModulesPurge=false --frozen-lockfile

      - name: Build all
        run: pnpm turbo build

      # Step 1: Run DB migrations BEFORE any Worker deploy
      - name: Run database migrations
        run: pnpm --filter @zync/db exec drizzle-kit migrate
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}

      # Step 2: Deploy zync-api Worker
      - name: Deploy zync-api (production)
        run: pnpm --filter zync-api exec wrangler deploy --env production
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      # Step 3: Deploy zync-www + zync-app as Workers (both depend on zync-api being up)
      - name: Deploy zync-www (production)
        run: pnpm --filter zync-www exec wrangler deploy --env production
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      - name: Deploy zync-app (production)
        run: pnpm --filter zync-app exec wrangler deploy --env production
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
