deploy.yml

name: Deploy to Cloudflare

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  deployments: write
  pull-requests: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    name: Deploy ${{ github.event_name == 'pull_request' && 'preview' || 'production' }}

    # Pass Cloudflare creds to every step. The wrangler CLI picks these up
    # automatically from the standard env var names.
    env:
      # Accept either secret name: the repo's original secret is called
      # CLOUD_FLARE, which is why runs #1-#4 deployed nothing — wrangler saw
      # an empty CLOUDFLARE_API_TOKEN and refused, while `whoami` still
      # exited 0 and made the job look like it had authenticated.
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN || secrets.CLOUD_FLARE }}
      # Optional: wrangler only needs this when the token can see more than
      # one account. Left unset is fine.
      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
      # Force wrangler to be verbose so failures surface a real error
      # (the cloudflare/wrangler-action wrapper was eating stderr).
      WRANGLER_LOG: debug

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Show repo layout
        run: |
          echo "--- working tree ---"
          ls -la
          echo "--- wrangler.toml ---"
          cat wrangler.toml
          echo "--- src/worker.js ---"
          cat src/worker.js

      - name: Check secrets are present
        # Fail loudly here instead of letting wrangler swallow it.
        # We never print the token itself, just its length, so this is safe to log.
        run: |
          if [ -z "$CLOUDFLARE_API_TOKEN" ]; then
            echo "::error::No Cloudflare API token reached this job."
            echo "Add it at: https://github.com/cipherpine/cipherpine.com/settings/secrets/actions"
            echo "Accepted secret names: CLOUDFLARE_API_TOKEN (preferred) or CLOUD_FLARE."
            exit 1
          fi
          echo "Cloudflare API token: present (length=${#CLOUDFLARE_API_TOKEN})"
          if [ -z "$CLOUDFLARE_ACCOUNT_ID" ]; then
            echo "::notice::CLOUDFLARE_ACCOUNT_ID not set — fine while the token sees one account."
          else
            echo "CLOUDFLARE_ACCOUNT_ID: $CLOUDFLARE_ACCOUNT_ID"
          fi

      - name: Verify Cloudflare auth (whoami)
        # wrangler whoami exits 0 even when unauthenticated, so grep the output
        # to actually fail the step if the token wasn't recognized.
        run: |
          set -o pipefail
          npx --yes wrangler@4 whoami | tee whoami.out
          grep -qE "You are logged in|account email" whoami.out

      - name: Deploy
        run: npx --yes wrangler@4 deploy

      - name: Verify production actually serves this commit
        # A green wrangler run is NOT proof the site changed — runs #1-#4 all
        # ended without uploading anything. Fetch the deployed homepage and
        # compare it to the index.html in this commit.
        if: github.event_name != 'pull_request'
        run: |
          set -uo pipefail
          want=$(sha256sum index.html | cut -d' ' -f1)
          echo "expected sha256: $want"

          # Always log the HTTP status and byte count: the first version of
          # this step hid curl's failure behind `|| true` and reported a bare
          # "sha none", which said nothing about why.
          probe() {
            code=$(curl -sS -L --max-time 20 -o probe.html -w '%{http_code}' \
                   -A 'cipherpine-deploy-verify/1 (+https://github.com/cipherpine/cipherpine.com)' \
                   -H 'Cache-Control: no-cache' "$2" || echo 000)
            bytes=$(wc -c < probe.html 2>/dev/null || echo 0)
            sha=$(sha256sum probe.html 2>/dev/null | cut -d' ' -f1 || echo none)
            echo "$1: http=$code bytes=$bytes sha=$sha"
            [ "$sha" = "$want" ]
          }

          # 1) Authoritative check — the Worker's own hostname is not behind the
          #    zone's WAF or bot protection, so a datacenter curl can reach it.
          ok=0
          for i in 1 2 3 4 5; do
            if probe "worker attempt $i" \
                 "https://cipherpineweb.justin-parsons937.workers.dev/?ci=${GITHUB_SHA}-$i"; then
              ok=1; break
            fi
            sleep 10
          done
          if [ "$ok" != 1 ]; then
            echo "::error::wrangler exited 0 but the Worker is not serving this commit's index.html."
            exit 1
          fi
          echo "Worker is serving this commit."

          # 2) Custom domain — informational. Cloudflare bot protection may
          #    refuse CI's IP, so a block here is a notice, not a failure.
          if probe "cipherpine.com" "https://cipherpine.com/?ci=${GITHUB_SHA}-apex"; then
            echo "cipherpine.com is serving this commit."
          else
            echo "::notice::Could not confirm cipherpine.com from CI (see http= above); the Worker check passed, so the deploy landed."
          fi