deploy.yml

name: Deploy

on:
  repository_dispatch:
    types: [ci-main-success]
  workflow_dispatch:
    inputs:
      verbose:
        description: 'Show full build output instead of clean summary'
        type: boolean
        default: false

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write

jobs:
  deploy:
    name: Deploy Production
    runs-on: ubuntu-latest
    env:
      NEAR_PRIVATE_KEY: ${{ secrets.NEAR_PRIVATE_KEY }}
      # Zephyr server-token auth. Zephyr directly advised us to retain this flow for
      # our workflow even though server tokens are being deprecated in favor of CI
      # ZE_SECRET_TOKEN is used directly as the bearer token — no API exchange needed.
      # We fall back to ZE_CI_TOKEN (below) only if ZEPHYR_AUTH_TOKEN is unset.
      ZE_SECRET_TOKEN: ${{ secrets.ZEPHYR_AUTH_TOKEN }}
      ZE_USER_EMAIL: ${{ secrets.ZEPHYR_USER_EMAIL }}
      RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
      TARGET_BRANCH: ${{ github.ref_name }}
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 (Node 24)
        with:
          ref: ${{ env.TARGET_BRANCH }}

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.3.14"

      - name: Install dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Run postinstall
        run: bun run postinstall

      - name: Install NEAR CLI
        run: curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/download/v0.23.5/near-cli-rs-installer.sh | sh

      - name: Verify NEAR CLI
        run: near --version

      - name: Configure Zephyr CI token fallback
        if: ${{ env.ZE_SECRET_TOKEN == '' }}
        env:
          ZEPHYR_CI_TOKEN: ${{ secrets.ZEPHYR_CI_TOKEN }}
        run: |
          echo "ZE_CI_TOKEN=$ZEPHYR_CI_TOKEN" >> "$GITHUB_ENV"

      - name: Publish with deploy
        timeout-minutes: 20
        run: bun run bos publish --deploy${{ inputs.verbose == true && ' --verbose' || '' }}

      - name: Install Railway CLI
        run: npm i -g @railway/cli

      - name: Redeploy Railway
        run: railway redeploy --service app --yes

      - name: Commit and push bos.config.json updates
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add bos.config.json
          if ! git diff --cached --quiet; then
            git commit -m "chore: update deployment URLs [skip ci]"
            git push origin "$TARGET_BRANCH"
          fi