name: deploy

on:
  push:
    branches: [master]
  workflow_dispatch:

concurrency:
  group: deploy
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - run: bun install --frozen-lockfile

      - run: bun test

      - run: bun run build
        env:
          PARAGRAPH_API_KEY: ${{ secrets.PARAGRAPH_API_KEY }}
          PARAGRAPH_PUBLICATION_SLUG: ${{ secrets.PARAGRAPH_PUBLICATION_SLUG }}

      # Read-only preflight: fail before replacing the Worker if cron cannot claim.
      - name: Verify activity refresh migration
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: d1 execute kualta-newsletter --remote --config wrangler.jsonc --command "SELECT minute FROM activity_refresh LIMIT 1"

      # Before the site: this takes kualta.com, www and the one-page subdomains
      # over from the site Worker, whose deploy would otherwise detach them first.
      - name: Deploy redirect Worker
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: deploy --config wrangler.redirect.jsonc

      - uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: deploy --config dist/server/wrangler.json

      - name: Publish and verify Standard.site articles
        run: bun run atproto:publish
        env:
          ATP_APP_PASSWORD: ${{ secrets.ATP_APP_PASSWORD }}

      - name: Publish and verify music on ATProto
        if: vars.MUSIC_ATPROTO_ENABLED == 'true'
        run: bun run music:publish
        env:
          ATP_APP_PASSWORD: ${{ secrets.ATP_APP_PASSWORD }}
          PLYR_TOKEN: ${{ secrets.PLYR_TOKEN }}