deploy-workers.yml

name: Deploy Cloudflare Workers

on:
  workflow_dispatch:
    inputs:
      worker:
        description: 'Worker folder to deploy (e.g. services/app-builder)'
        required: true
        type: string
      target_environment:
        description: 'Worker environment to deploy to'
        required: false
        default: production
        type: choice
        options:
          - production
          - staging
  workflow_call:
    inputs:
      worker:
        description: 'Worker folder to deploy for single-worker calls'
        required: false
        default: ''
        type: string
      base_sha:
        description: 'Base SHA to diff against when detecting changed workers'
        required: false
        default: ''
        type: string
      target_environment:
        description: 'Worker environment to deploy to'
        required: false
        default: production
        type: string

permissions:
  contents: read

concurrency:
  group: deploy-workers
  cancel-in-progress: false

jobs:
  deploy-manual:
    if: inputs.worker != ''
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    name: Deploy ${{ inputs.worker }}
    environment: ${{ inputs.target_environment }}
    steps:
      - name: Checkout code
        uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        working-directory: ${{ inputs.worker }}
        run: pnpm install --frozen-lockfile

      - name: Deploy to Cloudflare Workers
        uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3.14.1
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          workingDirectory: ${{ inputs.worker }}
          # Workers that define a `predeploy` script (e.g. D1 migrations) run it
          # right before deploy; all other workers are unaffected.
          preCommands: |
            if [ "$(jq -r '.scripts.predeploy // empty' package.json)" != "" ]; then pnpm run predeploy; fi
          command: ${{ inputs.target_environment == 'production' && 'deploy' || format('deploy --env {0}', inputs.target_environment) }}

  detect-changes:
    if: inputs.worker == '' && (inputs.base_sha != '' || inputs.target_environment != 'production')
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 5
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout code
        uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          fetch-depth: 0

      - name: Find changed workers
        id: set-matrix
        run: |
          # Auto-discover all deployable workers (folders containing wrangler.jsonc)
          # and exclude workers that have their own deploy pipelines.
          #
          # Production diffs against the SHA before the push so that multi-commit
          # pushes don't miss workers touched in earlier commits. Staging deploys
          # only workers that explicitly define the named Wrangler environment.
          BASE_SHA="${{ inputs.base_sha }}"
          TARGET_ENVIRONMENT="${{ inputs.target_environment }}"

          has_named_environment() {
            node - "$1" "$TARGET_ENVIRONMENT" <<'NODE'
          const fs = require('node:fs');

          const [file, targetEnvironment] = process.argv.slice(2);

          function stripJsonComments(value) {
            let output = '';
            let inString = false;
            let escaped = false;

            for (let index = 0; index < value.length; index += 1) {
              const current = value[index];
              const next = value[index + 1];

              if (inString) {
                output += current;
                if (escaped) escaped = false;
                else if (current === '\\') escaped = true;
                else if (current === '"') inString = false;
                continue;
              }

              if (current === '"') {
                inString = true;
                output += current;
                continue;
              }

              if (current === '/' && next === '/') {
                while (index < value.length && value[index] !== '\n') index += 1;
                output += '\n';
                continue;
              }

              if (current === '/' && next === '*') {
                index += 2;
                while (index < value.length && !(value[index] === '*' && value[index + 1] === '/')) {
                  if (value[index] === '\n') output += '\n';
                  index += 1;
                }
                index += 1;
                continue;
              }

              output += current;
            }

            return output;
          }

          const rawConfig = fs.readFileSync(file, 'utf8');
          const config = JSON.parse(stripJsonComments(rawConfig).replace(/,\s*([}\]])/g, '$1'));
          process.exit(config.env && Object.hasOwn(config.env, targetEnvironment) ? 0 : 1);
          NODE
          }

          # Workers excluded from this workflow (they have custom deploy pipelines):
          EXCLUDED=(
            services/kiloclaw  # Docker-based deploy in deploy-production.yml
            services/gastown   # Deployed separately
            services/wasteland # Deployed separately
            services/deploy-infra/builder-docker-container/container-files  # Build artifact template, not a deployable worker
          )

          # Discover all workers with a wrangler.jsonc
          WORKERS=()
          while IFS= read -r cfg; do
            dir=$(dirname "$cfg")
            WORKERS+=("$dir")
          done < <(find services -name "wrangler.jsonc" -not -path "*/node_modules/*" | sort)

          # Filter out excluded workers
          DEPLOYABLE=()
          for dir in "${WORKERS[@]}"; do
            skip=false
            for excluded in "${EXCLUDED[@]}"; do
              if [[ "$dir" == "$excluded" ]]; then
                skip=true
                break
              fi
            done
            if [[ "$skip" == false ]]; then
              DEPLOYABLE+=("$dir")
            fi
          done

          if [ "$TARGET_ENVIRONMENT" = "production" ]; then
            CHANGED=()
            for dir in "${DEPLOYABLE[@]}"; do
              if git diff --name-only "$BASE_SHA" HEAD -- "$dir/" | grep -q .; then
                CHANGED+=("$dir")
              fi
            done
          else
            CHANGED=()
            for dir in "${DEPLOYABLE[@]}"; do
              if has_named_environment "$dir/wrangler.jsonc"; then
                CHANGED+=("$dir")
              else
                echo "Skipping $dir: wrangler.jsonc does not define env.$TARGET_ENVIRONMENT"
              fi
            done
          fi

          if [ ${#CHANGED[@]} -eq 0 ]; then
            echo "matrix=[]" >> "$GITHUB_OUTPUT"
          else
            MATRIX=$(printf '%s\n' "${CHANGED[@]}" | jq -R . | jq -sc .)
            echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"
          fi

  deploy-changed:
    needs: detect-changes
    if: needs.detect-changes.outputs.matrix != '[]' && needs.detect-changes.outputs.matrix != ''
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    environment: ${{ inputs.target_environment }}
    strategy:
      fail-fast: false
      matrix:
        worker: ${{ fromJson(needs.detect-changes.outputs.matrix) }}
    name: Deploy ${{ matrix.worker }}
    steps:
      - name: Checkout code
        uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        working-directory: ${{ matrix.worker }}
        run: pnpm install --frozen-lockfile

      - name: Deploy to Cloudflare Workers
        uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3.14.1
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          workingDirectory: ${{ matrix.worker }}
          # Workers that define a `predeploy` script (e.g. D1 migrations) run it
          # right before deploy; all other workers are unaffected.
          preCommands: |
            if [ "$(jq -r '.scripts.predeploy // empty' package.json)" != "" ]; then pnpm run predeploy; fi
          command: ${{ inputs.target_environment == 'production' && 'deploy' || format('deploy --env {0}', inputs.target_environment) }}