deploy-api-server.yml

name: Deploy API server

on:
  push:
    branches:
      - main
    paths:
      - 'apps/api-server/**'
  workflow_dispatch:

jobs:
  deploy:
    name: Deploy API server
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install mise
        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4

      - name: Install tools with mise
        run: mise install

      - name: Cache pnpm
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: ~/.pnpm-store
          key: ${{ runner.os }}-pnpm-api-server-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-api-server-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Apply D1 migrations BEFORE deploying. The new worker code may reference columns a migration adds,
      # so the schema must be ready first. A deploy-then-migrate order silently drops every telemetry
      # write (the D1 inserts are fire-and-forget) until the migration runs. `--remote` targets prod;
      # wrangler auto-confirms in CI (non-interactive). Needs the CF token to have D1 edit permission.
      - name: Apply D1 migrations
        run: pnpm exec wrangler d1 migrations apply cmdr-telemetry --remote
        working-directory: ./apps/api-server
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      - name: Deploy to Cloudflare Workers
        run: pnpm exec wrangler deploy
        working-directory: ./apps/api-server
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}