docs.yml

name: 'Libra Docs Deploy'

on:
  workflow_dispatch:
  push:
    branches: [ main ]
    paths:
      - 'apps/docs/**'
      - 'tooling/typescript-config/**'
      - 'package.json'
      - 'turbo.json'
      - '.github/workflows/docs.yml'
      - 'bun.lock'
  pull_request:
    branches: [ main ]
    paths:
      - 'apps/docs/**'
      - 'tooling/typescript-config/**'
      - 'package.json'
      - 'turbo.json'
      - '.github/workflows/docs.yml'
      - 'bun.lock'

# Limit concurrent workflow runs
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  publish:
    name: Publish Docs to Cloudflare Workers
    runs-on: blacksmith-2vcpu-ubuntu-2204
    timeout-minutes: 15
    permissions:
      contents: read
      deployments: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'

      - name: 'Bun setup'
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: 1.2.19

      - name: Cache dependencies
        uses: useblacksmith/cache@v5
        id: bun-cache
        with:
          path: |
            **/node_modules
            ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-

      - name: Cache Next.js Build
        uses: useblacksmith/cache@v5
        with:
          path: |
            ${{ github.workspace }}/apps/docs/.next/cache
            ${{ github.workspace }}/apps/docs/.open-next
          # Generate a new cache whenever packages or source files change
          key: ${{ runner.os }}-nextjs-docs-${{ hashFiles('**/bun.lock') }}-${{ hashFiles('apps/docs/**/*.js', 'apps/docs/**/*.jsx', 'apps/docs/**/*.ts', 'apps/docs/**/*.tsx', 'apps/docs/**/*.md', 'apps/docs/**/*.mdx') }}
          # If source files changed but packages didn't, rebuild from a prior cache
          restore-keys: |
            ${{ runner.os }}-nextjs-docs-${{ hashFiles('**/bun.lock') }}-

      - name: Install Deps
        if: steps.bun-cache.outputs.cache-hit != 'true'
        run: bun install

      - name: Set version
        id: version
        run: echo "version=$(date +'%Y%m%d%H%M%S')-${GITHUB_SHA::7}" >> $GITHUB_OUTPUT

      - name: Build Docs
        run: |
          cd apps/docs
          bun run build
        continue-on-error: false

      - name: Deploy Docs
        id: deploy
        run: |
          cd apps/docs

          # Set environment variables securely (hidden from logs)
          echo "Setting up environment variables..."

          # Suppress Wrangler verbose logging to prevent secret exposure
          export WRANGLER_LOG=error

          # Public URLs (safe to show)
          export NEXT_PUBLIC_APP_URL="${{ secrets.NEXT_PUBLIC_APP_URL }}"
          export NEXT_PUBLIC_CDN_URL="${{ secrets.NEXT_PUBLIC_CDN_URL }}"
          export NEXT_PUBLIC_DEPLOY_URL="${{ secrets.NEXT_PUBLIC_DEPLOY_URL }}"
          export NEXT_PUBLIC_DISPATCHER_URL="${{ secrets.NEXT_PUBLIC_DISPATCHER_URL }}"
          export NEXT_PUBLIC_DOCS_URL="${{ secrets.NEXT_PUBLIC_DOCS_URL }}"
          export NEXT_PUBLIC_SCAN="${{ secrets.NEXT_PUBLIC_SCAN }}"
          export NEXT_PUBLIC_TURNSTILE_SITE_KEY="${{ secrets.NEXT_PUBLIC_TURNSTILE_SITE_KEY }}"
          export NEXT_PUBLIC_SANDBOX_DEFAULT_PROVIDER="${{ secrets.NEXT_PUBLIC_SANDBOX_DEFAULT_PROVIDER }}"
          export NEXT_PUBLIC_SANDBOX_BUILDER_DEFAULT_PROVIDER="${{ secrets.NEXT_PUBLIC_SANDBOX_BUILDER_DEFAULT_PROVIDER }}"
          export NEXT_PUBLIC_POSTHOG_KEY="${{ secrets.NEXT_PUBLIC_POSTHOG_KEY }}"
          export NEXT_PUBLIC_POSTHOG_HOST="${{ secrets.NEXT_PUBLIC_POSTHOG_HOST }}"
          export NEXT_PUBLIC_GITHUB_APP_URL="${{ secrets.NEXT_PUBLIC_GITHUB_APP_URL }}"
          export NEXT_PUBLIC_CLOUDFLARE_DCV_VERIFICATION_ID="${{ secrets.NEXT_PUBLIC_CLOUDFLARE_DCV_VERIFICATION_ID }}"
          export NEXT_PUBLIC_CUSTOMERS_IP_ADDRESS="${{ secrets.NEXT_PUBLIC_CUSTOMERS_IP_ADDRESS }}"

          # Authentication secrets
          export BETTER_AUTH_SECRET="${{ secrets.BETTER_AUTH_SECRET }}"
          export BETTER_GITHUB_CLIENT_ID="${{ secrets.BETTER_GITHUB_CLIENT_ID }}"
          export BETTER_GITHUB_CLIENT_SECRET="${{ secrets.BETTER_GITHUB_CLIENT_SECRET }}"

          # Security secrets
          export TURNSTILE_SECRET_KEY="${{ secrets.TURNSTILE_SECRET_KEY }}"

          # Database secrets
          export POSTGRES_URL="${{ secrets.POSTGRES_URL }}"
          export DATABASE_ID="${{ secrets.DATABASE_ID }}"

          # Azure AI secrets
          export AZURE_DEPLOYMENT_NAME="${{ secrets.AZURE_DEPLOYMENT_NAME }}"
          export AZURE_RESOURCE_NAME="${{ secrets.AZURE_RESOURCE_NAME }}"
          export AZURE_API_KEY="${{ secrets.AZURE_API_KEY }}"
          export AZURE_BASE_URL="${{ secrets.AZURE_BASE_URL }}"

          # Payment secrets
          export STRIPE_WEBHOOK_SECRET="${{ secrets.STRIPE_WEBHOOK_SECRET }}"
          export STRIPE_SECRET_KEY="${{ secrets.STRIPE_SECRET_KEY }}"

          # API Keys
          export RESEND_API_KEY="${{ secrets.RESEND_API_KEY }}"
          export RESEND_FROM="${{ secrets.RESEND_FROM }}"
          export E2B_API_KEY="${{ secrets.E2B_API_KEY }}"
          export DAYTONA_API_KEY="${{ secrets.DAYTONA_API_KEY }}"

          # Cloudflare secrets
          export CLOUDFLARE_ACCOUNT_ID="${{ secrets.CLOUDFLARE_ACCOUNT_ID }}"
          export CLOUDFLARE_API_TOKEN="${{ secrets.CLOUDFLARE_API_TOKEN }}"
          export CLOUDFLARE_AIGATEWAY_NAME="${{ secrets.CLOUDFLARE_AIGATEWAY_NAME }}"
          export CLOUDFLARE_ZONE_ID="${{ secrets.CLOUDFLARE_ZONE_ID }}"
          export CLOUDFLARE_SAAS_ZONE_ID="${{ secrets.CLOUDFLARE_SAAS_ZONE_ID }}"
          export HYPERDRIVE_ID="${{ secrets.HYPERDRIVE_ID }}"
          export KV_NAMESPACE_ID="${{ secrets.KV_NAMESPACE_ID }}"

          # GitHub secrets
          export LIBRA_GITHUB_TOKEN="${{ secrets.LIBRA_GITHUB_TOKEN }}"
          export LIBRA_GITHUB_OWNER="${{ secrets.LIBRA_GITHUB_OWNER }}"
          export LIBRA_GITHUB_REPO="${{ secrets.LIBRA_GITHUB_REPO }}"
          export GITHUB_APP_SLUG="${{ secrets.GITHUB_APP_SLUG }}"
          export GITHUB_APP_ID="${{ secrets.GITHUB_APP_ID }}"
          export GITHUB_APP_PRIVATE_KEY="${{ secrets.GITHUB_APP_PRIVATE_KEY }}"
          export GITHUB_APP_CLIENT_ID="${{ secrets.GITHUB_APP_CLIENT_ID }}"
          export GITHUB_APP_CLIENT_SECRET="${{ secrets.GITHUB_APP_CLIENT_SECRET }}"
          export GITHUB_WEBHOOK_SECRET="${{ secrets.GITHUB_WEBHOOK_SECRET }}"

          # Feature flags
          export ENHANCED_PROMPT="${{ secrets.ENHANCED_PROMPT }}"
          export REASONING_ENABLED="${{ secrets.REASONING_ENABLED }}"

          # Build configuration
          export DEPLOY_VERSION="${{ steps.version.outputs.version }}"
          export NEXT_TELEMETRY_DISABLED=1

          echo "Environment variables configured successfully"

          # Build and deploy using opennextjs-cloudflare
          npx opennextjs-cloudflare build
          npx opennextjs-cloudflare deploy -- --keep-vars
        continue-on-error: false

      - name: Create deployment
        uses: chrnorm/deployment-action@v2
        if: success() && github.event_name != 'pull_request'
        with:
          token: ${{ secrets.LIBRA_GITHUB_TOKEN }}
          environment: docs-production
          environment-url: https://docs.libra.dev
          description: 'Deployed docs version ${{ steps.version.outputs.version }}'
          ref: ${{ github.sha }}