deploy.yml

name: Deploy & Smoke Test

on:
  workflow_call:
    inputs:
      worker_name:
        description: "Cloudflare Worker name"
        required: true
        type: string
      wrangler_config:
        description: "Wrangler config filename (in examples/cf-workers/)"
        required: true
        type: string
      environment:
        description: "GitHub environment name (preview, staging, production)"
        required: true
        type: string
      oidc_issuer_override:
        description: "Override OIDC_PROVIDER_ISSUER var (for dynamic preview URLs)"
        required: false
        type: string
        default: ""
      set_secrets:
        description: "Whether to set worker secrets after deploy"
        required: false
        type: boolean
        default: true
    outputs:
      deploy_url:
        description: "The deployed worker URL"
        value: ${{ jobs.deploy.outputs.deploy_url }}
    secrets:
      CLOUDFLARE_API_TOKEN:
        required: true
      CLOUDFLARE_ACCOUNT_ID:
        required: true
      SESSION_TOKEN_KEY:
        required: true
      OIDC_PROVIDER_KEY:
        required: true

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    outputs:
      deploy_url: ${{ steps.url.outputs.deploy_url }}
    env:
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Deploy worker
        id: deploy
        run: |
          EXTRA_ARGS=""
          if [ -n "${{ inputs.oidc_issuer_override }}" ]; then
            EXTRA_ARGS="--var OIDC_PROVIDER_ISSUER:${{ inputs.oidc_issuer_override }}"
          fi
          npx wrangler deploy \
            --cwd examples/cf-workers \
            --config ${{ inputs.wrangler_config }} \
            --name "${{ inputs.worker_name }}" \
            $EXTRA_ARGS

      - name: Get deploy URL
        id: url
        run: |
          URL="https://${{ inputs.worker_name }}.${{ vars.CLOUDFLARE_WORKERS_SUBDOMAIN }}.workers.dev"
          echo "deploy_url=$URL" >> "$GITHUB_OUTPUT"

      - name: Set worker secrets
        if: inputs.set_secrets
        env:
          SESSION_TOKEN_KEY: ${{ secrets.SESSION_TOKEN_KEY }}
          OIDC_PROVIDER_KEY: ${{ secrets.OIDC_PROVIDER_KEY }}
        run: |
          echo "$SESSION_TOKEN_KEY" | npx wrangler secret put SESSION_TOKEN_KEY --cwd examples/cf-workers --config ${{ inputs.wrangler_config }} --name "${{ inputs.worker_name }}"
          echo "$OIDC_PROVIDER_KEY" | npx wrangler secret put OIDC_PROVIDER_KEY --cwd examples/cf-workers --config ${{ inputs.wrangler_config }} --name "${{ inputs.worker_name }}"

      - name: Wait for deployment to be live
        run: |
          URL="${{ steps.url.outputs.deploy_url }}"
          for i in $(seq 1 30); do
            if curl -sf -o /dev/null -w "%{http_code}" "$URL" 2>/dev/null; then
              echo "Deployment is live"
              exit 0
            fi
            echo "Attempt $i: waiting for deployment..."
            sleep 2
          done
          echo "Deployment did not become live in time"
          exit 1

  smoke-test:
    name: Smoke Test
    needs: deploy
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    env:
      DEPLOY_URL: ${{ needs.deploy.outputs.deploy_url }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5

      - name: Run smoke tests
        run: uvx --with pytest,boto3,requests pytest tests/smoke/ -v