zaati-os/.github/workflows/deploy-cloudflare.yml at dbdb64ebd279170f038bdf916202a72ac84858b8 · mohsinht/zaati-os · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
name: Deploy private dashboard

on:
  workflow_dispatch:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: zaati-production
  cancel-in-progress: false

jobs:
  deploy:
    if: github.event_name == 'workflow_dispatch' || vars.ZAATI_AUTO_DEPLOY == 'true'
    environment: production
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    env:
      ZAATI_HOSTNAME: ${{ vars.ZAATI_HOSTNAME }}
      ZAATI_WORKER_NAME: ${{ vars.ZAATI_WORKER_NAME }}
      ZAATI_INSTANCE_CONFIG_JSON: ${{ secrets.ZAATI_INSTANCE_CONFIG_JSON }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Generate private instance configuration
        if: env.ZAATI_INSTANCE_CONFIG_JSON != ''
        run: npm run instance:configure -- --from-env --force
      - name: Verify Access before private data checkout
        if: ${{ vars.ZAATI_DATA_REPOSITORY != '' }}
        run: |
          test "${{ vars.ZAATI_ACCESS_VERIFIED }}" = "true"
          npm run access:verify -- "$ZAATI_HOSTNAME"
      - name: Checkout private snapshot repository
        if: ${{ vars.ZAATI_DATA_REPOSITORY != '' }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ vars.ZAATI_DATA_REPOSITORY }}
          ref: ${{ vars.ZAATI_DATA_REF || 'main' }}
          token: ${{ secrets.ZAATI_DATA_REPOSITORY_TOKEN }}
          path: .private-data
          persist-credentials: false
      - name: Import private snapshots without logging content
        if: ${{ vars.ZAATI_DATA_REPOSITORY != '' }}
        run: node scripts/import-private-data.mjs .private-data/data/snapshots
      - run: npm run check
        env:
          ZAATI_SNAPSHOT_KEY: ${{ secrets.ZAATI_SNAPSHOT_KEY }}
      - run: npm run deployment:configure
      - name: Deploy Worker static assets
        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: deploy --config .wrangler.generated.jsonc
      - name: Verify unauthenticated challenge after deploy
        if: ${{ vars.ZAATI_DATA_REPOSITORY != '' }}
        run: npm run access:verify -- "$ZAATI_HOSTNAME"