deploy-workers.yml

name: Deploy Cloudflare Workers

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      worker:
        description: 'Worker folder to deploy (e.g. services/app-builder)'
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: deploy-workers-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # ── Manual dispatch: deploy a single specified worker ──────────────────────
  deploy-manual:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    name: Deploy ${{ inputs.worker }}
    steps:
      - name: Checkout code
        uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        working-directory: ${{ inputs.worker }}
        run: pnpm install --frozen-lockfile

      - name: Deploy to Cloudflare Workers
        uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3.14.1
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          workingDirectory: ${{ inputs.worker }}
          command: deploy

  # ── Push to main: detect changed workers, deploy each one ─────────────────
  detect-changes:
    if: github.event_name == 'push'
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 5
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout code
        uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          fetch-depth: 0

      - name: Find changed workers
        id: set-matrix
        run: |
          # Auto-discover all deployable workers (folders containing wrangler.jsonc)
          # and exclude workers that have their own deploy pipelines.
          #
          # Diff against the SHA before the push so that multi-commit pushes
          # (e.g. a merge commit that squashes several commits) don't miss workers
          # that were only touched in earlier commits of the same push.
          BASE_SHA="${{ github.event.before }}"

          # Workers excluded from this workflow (they have custom deploy pipelines):
          EXCLUDED=(
            services/kiloclaw  # Docker-based deploy in deploy-production.yml
            services/gastown   # Deployed separately
            services/deploy-infra/builder-docker-container/container-files  # Build artifact template, not a deployable worker
          )

          # Discover all workers with a wrangler.jsonc
          WORKERS=()
          while IFS= read -r cfg; do
            dir=$(dirname "$cfg")
            WORKERS+=("$dir")
          done < <(find services -name "wrangler.jsonc" -not -path "*/node_modules/*" | sort)

          # Filter out excluded workers
          DEPLOYABLE=()
          for dir in "${WORKERS[@]}"; do
            skip=false
            for excluded in "${EXCLUDED[@]}"; do
              if [[ "$dir" == "$excluded" ]]; then
                skip=true
                break
              fi
            done
            if [[ "$skip" == false ]]; then
              DEPLOYABLE+=("$dir")
            fi
          done

          CHANGED=()
          for dir in "${DEPLOYABLE[@]}"; do
            if git diff --name-only "$BASE_SHA" HEAD -- "$dir/" | grep -q .; then
              CHANGED+=("$dir")
            fi
          done

          if [ ${#CHANGED[@]} -eq 0 ]; then
            echo "matrix=[]" >> "$GITHUB_OUTPUT"
          else
            MATRIX=$(printf '%s\n' "${CHANGED[@]}" | jq -R . | jq -sc .)
            echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"
          fi

  deploy-changed:
    needs: detect-changes
    if: needs.detect-changes.outputs.matrix != '[]' && needs.detect-changes.outputs.matrix != ''
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        worker: ${{ fromJson(needs.detect-changes.outputs.matrix) }}
    name: Deploy ${{ matrix.worker }}
    steps:
      - name: Checkout code
        uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        working-directory: ${{ matrix.worker }}
        run: pnpm install --frozen-lockfile

      - name: Deploy to Cloudflare Workers
        uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3.14.1
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          workingDirectory: ${{ matrix.worker }}
          command: deploy