deploy-docs.yml

name: Deploy Docs

# The documentation site (apps/docs) is a static Starlight build deployed to a
# Cloudflare Pages project (statusbeam-docs). It has no D1/KV or config
# dependencies, so it deploys independently of the production status page (see
# deploy.yml). CLOUDFLARE_API_TOKEN must include the "Cloudflare Pages: Edit"
# permission (Workers-only tokens will fail the pages deploy).
on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - 'apps/docs/**'
      - .github/workflows/deploy-docs.yml

# Least privilege — Wrangler authenticates with the API token, not the GITHUB_TOKEN.
permissions:
  contents: read

# Never let two docs deploys race.
concurrency:
  group: deploy-docs
  cancel-in-progress: false

jobs:
  deploy:
    name: Deploy docs to Cloudflare
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment: production # add protection rules (approvals) in repo settings
    steps:
      - name: Preflight — required secrets present
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          missing=""
          [ -n "$CLOUDFLARE_API_TOKEN" ] || missing="$missing CLOUDFLARE_API_TOKEN(secret)"
          [ -n "$CLOUDFLARE_ACCOUNT_ID" ] || missing="$missing CLOUDFLARE_ACCOUNT_ID(secret)"
          if [ -n "$missing" ]; then
            echo "::error::Missing required config:$missing — see DEPLOYMENT.md"
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false # deploy auths via CLOUDFLARE_API_TOKEN, not git

      - name: Set up mise (node + bun)
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0

      - name: Install dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Build docs (fail fast before touching production)
        run: bun run --filter '@statusbeam/docs' build

      - name: Deploy docs
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: bun run --filter '@statusbeam/docs' deploy:publish