deploy.yml

name: GitHub Pages

on:
  push:
    branches:
      - master

jobs:
  deploy:
    name: Deploy to GitHub Pages
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js 18
        uses: actions/setup-node@v4
        with:
          node-version: '18'

      - name: Get yarn cache directory path
        id: yarn-cache-dir-path
        run: echo "::set-output name=dir::$(yarn cache dir)"

      - name: Cache yarn dependencies
        uses: actions/cache@v4
        with:
          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
          restore-keys: |
            ${{ runner.os }}-yarn-

      - name: Install
        run: yarn

      - name: Build
        env:
          # Webpack 4 (bundled with CRA 3) uses MD4 hashes, which OpenSSL 3
          # in Node 18+ disables by default. The legacy provider brings them
          # back. Safe to remove once react-scripts is upgraded to v5.
          NODE_OPTIONS: --openssl-legacy-provider
          # Repo variable — non-secret, visible in workflow logs.
          REACT_APP_SUBGRAPH_URI: ${{ vars.REACT_APP_SUBGRAPH_URI }}
          # Repo secret — used to authorize against The Graph gateway.
          # Anyone can extract this from the published bundle; rotate
          # if it leaks. Long-term, proxy the request through a server.
          REACT_APP_GATEWAY_TOKEN: ${{ secrets.REACT_APP_GATEWAY_TOKEN }}
        run: yarn build

      - name: Deploy
        uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./build