deploy.yml

name: Build & deploy the Null sites

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
  schedule:
    - cron: '0 6 * * 1' # weekly: re-hash every pinned release asset against the trust manifest

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || 'pages' }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
        with:
          version: 10.25.0

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - name: Static and content checks
        run: pnpm check && pnpm check:content && pnpm check:infra && pnpm test:unit && pnpm test:release

      - name: Verify pinned release assets
        if: github.event_name == 'schedule'
        run: pnpm test:release:network

      - name: Install browser for UI quality gates
        if: github.event_name != 'schedule'
        run: pnpm exec playwright install --with-deps chromium webkit

      - name: Build all sites
        if: github.event_name != 'schedule'
        run: pnpm build:all
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Build legacy HTTP redirect bundles
        if: github.event_name != 'schedule'
        run: pnpm build:redirects

      - name: Validate production artifacts
        if: github.event_name != 'schedule'
        run: pnpm check:build

      - name: Run responsive and accessibility contracts
        if: github.event_name != 'schedule'
        run: pnpm exec playwright test

      - name: Upload browser diagnostics
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: playwright-diagnostics
          path: |
            test-results/
            playwright-report/
          if-no-files-found: ignore
          retention-days: 7

      # apex — nullmenu.ai, served by this repo's GitHub Pages
      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
        with:
          path: build/menu

      - name: Upload product builds
        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: product-sites
          path: build/
          retention-days: 1

      - name: Upload legacy redirect bundles
        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: legacy-redirects
          path: build/redirects/
          retention-days: 1

  # The protected Pages environment gates the whole release before any product
  # ref moves. Products are staged and promoted first; apex is published last;
  # one finalizer restores the products on handoff, apex or cancellation failure.
  deploy-release:
    needs: build
    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: product-sites
          path: build

      - name: Deploy product sites as one release
        run: node scripts/deploy-subdomains.js --manifest build/deployment/subdomains.json
        env:
          NULLMENU_DEPLOY_TOKEN: ${{ secrets.NULLMENU_DEPLOY_TOKEN }}

      - name: Upload deployment rollback state
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: deployment-state
          path: build/deployment/subdomains.json
          retention-days: 7

      - id: deployment
        name: Deploy apex last
        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

      - name: Roll back product refs if apex deployment fails
        if: (failure() || cancelled()) && hashFiles('build/deployment/subdomains.json') != ''
        env:
          NULLMENU_DEPLOY_TOKEN: ${{ secrets.NULLMENU_DEPLOY_TOKEN }}
        run: node scripts/rollback-subdomains.js build/deployment/subdomains.json

  # `_worker.js` returns real 308 responses on Cloudflare Pages. These two
  # optional deploys activate when the account secrets and Pages projects are
  # configured; GitHub Pages itself cannot emit redirect status codes.
  deploy-legacy-redirects:
    needs: build
    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    runs-on: ubuntu-latest
    env:
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: legacy-redirects
          path: build/redirects

      - name: Deploy nullclaw.io redirects
        if: env.CLOUDFLARE_API_TOKEN != '' && env.CLOUDFLARE_ACCOUNT_ID != ''
        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: pages deploy build/redirects/nullclaw.io --project-name=nullclaw-io-redirect --branch=main

      - name: Deploy nullhub.io redirects
        if: env.CLOUDFLARE_API_TOKEN != '' && env.CLOUDFLARE_ACCOUNT_ID != ''
        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: pages deploy build/redirects/nullhub.io --project-name=nullhub-io-redirect --branch=main

      - name: Explain inactive legacy deployment
        if: env.CLOUDFLARE_API_TOKEN == '' || env.CLOUDFLARE_ACCOUNT_ID == ''
        run: echo 'Legacy redirect bundles are valid but require Cloudflare Pages credentials and domain binding.'