ote-tools/.github/workflows/deploy-validator.yml at main · OpenTechEvents/ote-tools · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# Deploys workers/validator to Cloudflare: the validator page AND its
# SSRF-guarded fetch endpoint, on one origin
# (validator.opentechevents.org).
#
# Separate from deploy-tools.yml on purpose. That workflow publishes static
# bundles to this repo's GitHub Pages; a Worker is neither static nor served
# from Pages, and this one carries the page with it as its `assets` binding.
# GitHub Pages keeps serving /validator/ as a redirect to the canonical URL.
#
# One-time prerequisite: a CLOUDFLARE_API_TOKEN repository secret with the
# "Edit Cloudflare Workers" template plus read access to the
# opentechevents.org zone (the custom domains are declared in wrangler.jsonc,
# so a deploy re-asserts them).
name: Deploy validator

on:
  push:
    branches: [main]
    paths:
      - "apps/validator/**"
      - "workers/validator/**"
      - "packages/discover-feed/**"
      - "packages/validate/**"
      - ".github/workflows/deploy-validator.yml"
  workflow_dispatch:

concurrency:
  group: validator
  cancel-in-progress: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      # The Worker's `assets` directory is apps/validator/dist, so the page has
      # to exist before wrangler runs. `pnpm build` builds every workspace
      # package the bundle imports as well.
      - run: pnpm build

      - name: Deploy
        run: pnpm --filter @opentechevents/validator-service exec wrangler deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

      - name: Smoke check
        run: |
          set -euo pipefail
          base=https://validator.opentechevents.org
          curl -fsS "$base/health" > /dev/null
          # The endpoint's whole purpose is refusing these; a deploy that
          # stopped refusing them is worse than a deploy that failed.
          for probe in "file:///etc/passwd" "http://169.254.169.254/"; do
            code=$(curl -s -o /dev/null -w '%{http_code}' "$base/fetch?url=$(printf %s "$probe" | jq -sRr @uri)")
            test "$code" = "400" || { echo "SSRF probe $probe answered $code, expected 400"; exit 1; }
          done