deploy.yml

# FRAMEWORK-OWNED — reconciled from the parent template by `bos sync` / `bos upgrade`.
# Local edits are allowed: on the next sync the template version wins and your copy
# is backed up under `.bos/sync-backup/`. To make a change permanent, file an issue:
# https://github.com/NEARBuilders/everything-dev/issues
# Deploy train: preflight → build → upload bundles → publish config + platform
# manifest → image (pre-pushed digest or local docker build) → post-publish
# smoke (--smoke) → Railway.
#
# Triggers directly on push to main and re-verifies, per run: the commit is
# still the main tip and the merged diff is runtime-relevant.
name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      verbose:
        description: 'Show full build output instead of clean summary'
        type: boolean
        default: false

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  pull-requests: read
  packages: write

jobs:
  # Deploy gate: only while the commit is still the tip of main, and only
  # when the merged diff touches runtime-relevant paths. Manual dispatches
  # must run against main.
  gate:
    name: Verify deploy is current
    if: >-
      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') ||
      github.event_name == 'push'
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      deploy: ${{ steps.tip.outputs.current == 'true' && steps.relevance.outputs.relevant == 'true' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 (Node 24)
        with:
          ref: ${{ github.sha }}
          fetch-depth: 2

      # The queued run for the new tip deploys instead.
      - name: Verify the deployed commit is still the main tip
        id: tip
        run: |
          git fetch --no-tags origin main
          TIP="$(git rev-parse origin/main)"
          SHA="$(git rev-parse HEAD)"
          if [ "$SHA" = "$TIP" ]; then
            echo "current=true" >> "$GITHUB_OUTPUT"
          else
            echo "current=false" >> "$GITHUB_OUTPUT"
            echo "::notice::Skipping deploy — main advanced past the validated commit ($SHA → $TIP). The queued run for the new tip deploys instead."
          fi

      # Relevance gate: skip the full deploy train when the merged diff touches
      # no runtime-affecting paths (docs/tests/workflows/changesets only).
      # Merge commits (PR merges) diff exactly the PR's files; single-commit
      # direct pushes too. Any uncertainty errs toward deploying, and manual
      # dispatches always deploy.
      - name: Check the diff for runtime-relevant paths
        id: relevance
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "relevant=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if ! git rev-parse HEAD^ >/dev/null 2>&1; then
            echo "::notice::No parent commit — assuming runtime-relevant"
            echo "relevant=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          FILES="$(git diff --name-only HEAD^ HEAD)"
          if [ -z "$FILES" ]; then
            echo "::notice::Empty first-parent diff (merge-tangle history) — assuming runtime-relevant"
            echo "relevant=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if echo "$FILES" | grep -qE '^Dockerfile$|^railway\.toml$|^scripts/|^host/|^api/|^ui/|^plugins/|^packages/|^bos\.app\.ts$|^bos\.dev\.ts$|^biome\.json$|^\.env\.test$|^(package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml|tsconfig\.json|tsconfig\.base\.json)$|^\.github/workflows/(ci|deploy|release)\.yml$|^\.github/templates/'; then
            echo "relevant=true" >> "$GITHUB_OUTPUT"
          else
            echo "relevant=false" >> "$GITHUB_OUTPUT"
            echo "::notice::Skipping deploy — the merged diff touches no runtime-relevant paths:"
            while IFS= read -r f; do echo "  $f"; done <<< "$FILES"
          fi

  # Image leg: build the `runtime` stage and push it to GHCR (sha-<short> +
  # version tags, latest held on prereleases) BEFORE any config/bundle publish,
  # so a failed image push cannot leave a partially published deploy. The
  # captured digest is handed to the deploy job (BOS_IMAGE_DIGEST), which pins
  # the pull-only Railway deploy to it. No pnpm install here — the Dockerfile
  # builds all workspaces from source in-image; the runner's preinstalled Node
  # reads the workspace version.
  image:
    name: Build and push runtime image
    needs: [gate]
    if: needs.gate.outputs.deploy == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    outputs:
      image: ${{ steps.push.outputs.image }}
      digest: ${{ steps.push.outputs.digest }}
    steps:
      - name: Checkout code
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 (Node 24)
        with:
          ref: ${{ github.sha }}

      - name: Log in to GHCR
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Build and push the runtime image
        id: push
        # Mirrors the CLI image leg (packages/everything-dev/src/services/deploy/image.ts
        # — buildAndPushImage/computeImageTags): image ref via BOS_IMAGE →
        # derived from the repository (ci.image in bos.app.ts is not parsed
        # here); tags sha-<short> always, the exact v<version> tag, and the
        # floating v<major> + :latest on stable releases only — :latest is held
        # during prereleases, and :rc is pushed as the floating prerelease-train
        # ref. A non-semver workspace version pushes sha-<short> plus :latest
        # (same parity as computeImageTags). Keep in sync with
        # computeImageTags when either side changes.
        env:
          BOS_IMAGE: ${{ vars.BOS_IMAGE }}
        run: |
          set -euo pipefail
          IMAGE="${BOS_IMAGE:-ghcr.io/$(echo "$GITHUB_REPOSITORY" | tr '[:upper:]' '[:lower:]')}"
          SHORT_SHA="$(git rev-parse --short=7 HEAD)"
          VERSION="$(node -p "require('./packages/everything-dev/package.json').version")"

          PUSH_LATEST=0
          PUSH_RC=0
          if [[ "$VERSION" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(-[0-9A-Za-z.-]+)?$ ]]; then
            EXACT="v${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.${BASH_REMATCH[3]}${BASH_REMATCH[4]}"
            if [ -n "${BASH_REMATCH[4]}" ]; then
              TAGS=("sha-$SHORT_SHA" "$EXACT")
              PUSH_RC=1
              echo "::notice::latest held: $EXACT is a prerelease — :latest still serves the last stable image; :rc tracks the prerelease train"
            else
              TAGS=("sha-$SHORT_SHA" "$EXACT" "v${BASH_REMATCH[1]}")
              PUSH_LATEST=1
            fi
          else
            TAGS=("sha-$SHORT_SHA")
            PUSH_LATEST=1
          fi

          REFS=("${TAGS[@]/#/$IMAGE:}")
          if [ "$PUSH_LATEST" = "1" ]; then
            REFS+=("$IMAGE:latest")
          fi
          if [ "$PUSH_RC" = "1" ]; then
            REFS+=("$IMAGE:rc")
          fi
          BUILD_ARGS=(--build-arg "BOS_GIT_SHA=$(git rev-parse HEAD)")
          for ref in "${REFS[@]}"; do
            BUILD_ARGS+=(-t "$ref")
          done
          echo "Building runtime image ${REFS[*]}..."
          # Registry build cache: the CI regression-image job exports the
          # shared builder-stage layers for this same SHA minutes earlier —
          # the install + framework-build layers hit, leaving only the
          # manifest-gen/prod-builder/runtime stages to build fresh.
          # --push uploads all tags in one shot; digests are captured
          # registry-side via imagetools inspect below (no local image store
          # with the docker-container driver, so `docker push` is not used).
          docker buildx create --use --name bos-deploy-builder
          CACHE_REF="$IMAGE:buildcache"
          BUILD_ARGS+=(
            --cache-from "type=registry,ref=$CACHE_REF"
            --cache-to "type=registry,ref=$CACHE_REF,mode=max"
            --push
          )
          # Retry the build — base-image metadata comes from public.ecr.aws
          # (the Docker Hub mirror), whose anonymous per-IP data limit
          # intermittently 429s the shared runner pool.
          BUILD_OK=0
          for attempt in 1 2 3; do
            if docker buildx build --target runtime "${BUILD_ARGS[@]}" .; then
              BUILD_OK=1
              break
            fi
            if [ "$attempt" -lt 3 ]; then
              echo "::warning::docker build failed (attempt $attempt) — retrying in 60s"
              sleep 60
            fi
          done
          if [ "$BUILD_OK" != "1" ]; then
            echo "::error::docker build failed after 3 attempts"
            exit 1
          fi

          # All tags are built from one image, so every ref must resolve to
          # the same digest — the Railway pin depends on it.
          DIGEST=""
          for ref in "${REFS[@]}"; do
            REF_DIGEST="$(docker buildx imagetools inspect "$ref" 2>/dev/null | grep -oE 'sha256:[a-f0-9]{64}' | head -1 || true)"
            if [ -z "$REF_DIGEST" ]; then
              echo "::error::Could not capture the image digest for $ref"
              exit 1
            fi
            if [ -z "$DIGEST" ]; then
              DIGEST="$REF_DIGEST"
            elif [ "$REF_DIGEST" != "$DIGEST" ]; then
              echo "::error::Tag divergence: $ref resolves to $REF_DIGEST but ${REFS[0]} resolves to $DIGEST"
              exit 1
            fi
          done

          echo "image=$IMAGE" >> "$GITHUB_OUTPUT"
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

  deploy:
    name: Deploy Production
    needs: [gate, image]
    if: needs.gate.outputs.deploy == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    # Secrets and deployment inputs live on the step that consumes them —
    # not at job level, where every step (including third-party actions')
    # would see them.
    steps:
      - name: Checkout code
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 (Node 24)
        with:
          ref: ${{ github.sha }}

      - name: Guard — no stray bun artifacts
        run: |
          if [ -f bun.lock ]; then
            echo "::error::bun.lock present — bun re-migrated the workspace (ADR 0026). Delete bun.lock and re-run pnpm install."
            exit 1
          fi
      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"

      - name: Get pnpm store dir
        id: pnpm-cache
        run: echo "STORE_PATH=$(pnpm store path)" >> "$GITHUB_OUTPUT"

      - name: Cache pnpm store
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 (Node 24)
        with:
          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      # The Railway deploy leg shells out to the `railway` CLI — runners don't
      # ship it, and a missing binary surfaces as a silent instant exit-1
      # (execa spawn failure mapped to exit code 1 by the deploy's run helper).
      # Pinned to the exact current release (matches consumer-deploy.yml's
      # major pin, tightened here); bump deliberately.
      - name: Install Railway CLI
        run: npm i -g @railway/cli@5.71.0

      - name: Log in to GHCR
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin

      - name: Deploy (preflight → build → upload → publish → smoke → Railway pin)
        timeout-minutes: 55
        env:
          NEAR_PRIVATE_KEY: ${{ secrets.NEAR_PRIVATE_KEY }}
          # near-kit's default RPC (free.rpc.fastnear.com) accepts signed
          # broadcasts and silently drops them — pin the signing stack to an
          # endpoint with a real transaction pool.
          NEAR_RPC_URL: https://rpc.mainnet.near.org
          BOS_STORAGE_ORIGIN: https://upload.everything.dev
          BOS_STORAGE_API_KEY: ${{ secrets.BOS_STORAGE_API_KEY }}
          BOS_BUNDLE_CDN_ORIGIN: https://cdn.everything.dev
          RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
          # Workspace-scoped token + project/environment targeting — the root
          # repoint (`railway service source connect` to the smoked digest) needs
          # workspace scope; a project token alone only authorizes the plain
          # redeploy (same wiring as consumer-deploy.yml).
          RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
          RAILWAY_PROJECT_ID: ${{ vars.RAILWAY_PROJECT_ID }}
          RAILWAY_ENVIRONMENT_ID: ${{ vars.RAILWAY_ENVIRONMENT_ID }}
          # Pre-pushed image from the image job — bos deploy skips its local
          # image build/push and pins the Railway deploy to this digest. BOS_IMAGE
          # carries the exact pushed ref so the pin pairs with the digest (with a
          # digest present, ci.image is excluded from ref resolution — it is a
          # build-time choice, not a pin-time one).
          BOS_IMAGE: ${{ needs.image.outputs.image }}
          BOS_IMAGE_DIGEST: ${{ needs.image.outputs.digest }}
        # One command runs the deploy train (ADR 0020/0021, image leg split
        # into the `image` job): staleness-checked prerequisite builds +
        # workspace dists, bundle upload to the R2-backed storage, FastKV
        # publish with read-back confirmation, then the post-publish boot
        # smoke — the runtime image pinned by this train boots against the
        # just-published config (health/SSR/OpenAPI/in-image mf check) — and
        # only then a pull-only Railway deploy pinned to the digest pushed by
        # the image job (BOS_IMAGE_DIGEST) via a generated thin Dockerfile. A
        # red smoke rolls the config back to the previous snapshot; the image
        # and the published bundles are same-SHA by construction, so the
        # gate is where image/bundle/version lockstep is enforced.
        run: pnpm run bos deploy${{ inputs.verbose == true && ' --verbose' || '' }} --smoke

      - name: Upload smoke artifacts on failure
        if: failure()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 (Node 24)
        with:
          name: image-smoke-artifacts
          path: .bos/logs/**

      # The former "Deploy smoke" step (host test:integration:remote) is
      # retired (plan 051): its premise — a local bos.config.json carrying
      # production URLs — no longer holds (production URLs are pipeline
      # state, published to FastKV; bos.app.ts:6). Its coverage is kept by
      # the post-publish smoke above (boots the pinned image against the
      # published config: /health, SSR HTML, spec.json, in-image mf check)
      # and the CI browser start:* regression modes. The host helper
      # (host/tests/helpers/runtime-remote.ts) now reads the resolved config
      # and remains a local diagnostic with honest skip reasons when
      # production URLs are absent.