ci: merge CI and deploy into push-to-main workflow

Replace tag-based deployment with automatic deploy on push to main.
PRs only run checks (type check + tests + build), no deploy.
Remove the separate deploy.yml workflow.

Author: fullstackjam

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: CI
+name: CI / Deploy
 
 on:
   push:
@@ -7,28 +7,28 @@ on:
     branches: [main]
 
 jobs:
-  test:
+  check:
     runs-on: ubuntu-latest
     permissions:
       id-token: write
       contents: read
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: '20'
-      
+
       - name: Install dependencies
         run: npm install --legacy-peer-deps
-      
+
       - name: Type check
         run: npm run check
 
       - name: Run tests with coverage
         run: npm run test:coverage
-      
+
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v4
         with:
@@ -37,6 +37,60 @@ jobs:
           flags: unittests
           name: openboot-web-coverage
           fail_ci_if_error: false
-      
+
+      - name: Build
+        run: npm run build
+
+  deploy:
+    needs: check
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: npm install --legacy-peer-deps
+
       - name: Build
         run: npm run build
+
+      - name: Run D1 Migrations
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: npx wrangler d1 migrations apply openboot --remote
+
+      - name: Deploy
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+
+      - name: Health Check
+        run: |
+          echo "Waiting 10 seconds for deployment to propagate..."
+          sleep 10
+
+          echo "Running health check..."
+          HEALTH_RESPONSE=$(curl -s https://openboot.dev/api/health)
+          echo "Health check response: $HEALTH_RESPONSE"
+
+          STATUS=$(echo $HEALTH_RESPONSE | jq -r '.status')
+          if [ "$STATUS" != "healthy" ]; then
+            echo "Health check failed! Status: $STATUS"
+            echo "Full response: $HEALTH_RESPONSE"
+            exit 1
+          fi
+
+          echo "Health check passed!"
+          echo "API: $(echo $HEALTH_RESPONSE | jq -r '.checks.api')"
+          echo "Database: $(echo $HEALTH_RESPONSE | jq -r '.checks.database')"
+          echo "Version: $(echo $HEALTH_RESPONSE | jq -r '.version')"

.github/workflows/deploy.yml

@@ -78,14 +78,9 @@ D1 (SQLite), no ORM — direct parameterized SQL via `env.DB.prepare(sql).bind(.
 
 ## CI/CD
 
-Tag-based releases. Push to `main` runs CI only (tests + build). Push a version tag (`v*`) triggers deployment:
+Push to `main` runs CI (type check + tests + build) then auto-deploys. PRs only run CI, no deploy.
 
-```bash
-git tag v1.2.3
-git push origin v1.2.3
-```
-
-Deploy workflow: test → build → D1 migrations → wrangler deploy. Migrations run before deploy — safe for schema changes that new code depends on.
+Deploy pipeline: check (type check → test → build) → deploy (build → D1 migrations → wrangler deploy → health check). Migrations run before deploy — safe for schema changes that new code depends on.
 
 ## Testing