deploy-pages.yml

name: deploy-pages

# Build the in-browser demo (crates/bdinfo-rs-wasm/web) and deploy it to
# Cloudflare Pages (Direct Upload) at bdinfo.hyperslop.dev. The wasm toolchain
# runs HERE on GitHub, where it already works; Cloudflare only HOSTS the prebuilt
# static files (its build image has no Rust / wasm-bindgen). The npm package ships
# lean (no demo); this deploys the FULL demo (index.html + the favicon PNGs +
# dist/ + pkg/) assembled into site/.
#
# ONE-TIME human prerequisites (until both are done, the auto-run on master fails
# harmlessly — this is NOT a required check, so it never blocks a merge):
#   1. Create the Cloudflare Pages project `bdinfo-rs` (Direct Upload) and attach
#      bdinfo.hyperslop.dev via the Pages dashboard (auto-CNAME, the zone is
#      already on Cloudflare). The FIRST deploy is manual:
#        cd crates/bdinfo-rs-wasm/web && npm ci && npm run build
#        # assemble site/ (index.html + icons + _headers + dist/ + pkg/), then:
#        npx wrangler login
#        npx wrangler pages deploy site --project-name=bdinfo-rs
#      Set the project's production branch to `master` so this workflow's
#      `--branch=master` deploy is the production one.
#   2. Add CLOUDFLARE_API_TOKEN (a token scoped to Pages:Edit) and CLOUDFLARE_ACCOUNT_ID
#      as ENVIRONMENT secrets on the `pages` environment (gated to the master branch),
#      NOT repo secrets — so only a master deploy can read the Pages deploy token.

on:
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - crates/bdinfo-rs-wasm/**
      # The wasm crate is a thin shim over bdinfo-rs-core (renderer, codecs,
      # MPLS/CLPI/M2TS) — a core change alters the demo's output, so redeploy on it.
      - crates/bdinfo-rs-core/**

permissions:
  contents: read

concurrency:
  group: deploy-pages
  cancel-in-progress: true

jobs:
  deploy:
    name: build + deploy the demo to Cloudflare Pages
    runs-on: ubuntu-latest
    # CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID are ENVIRONMENT secrets on `pages`
    # (not repo secrets), so only a deploy from master can read them. The push trigger
    # is master-only (github.ref = master), matched by the environment's `master` branch
    # rule; a workflow_dispatch from any other branch is intentionally locked out of the
    # production Pages token. No tag rule — there is no tag trigger here.
    environment: pages
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - id: pins
        uses: ./.github/actions/pins

      # The wasm32 target, the pinned wasm-bindgen CLI, the pinned Node, `npm ci`
      # and `npm run build` — the same block wasm.yml gates with and
      # publish-npm.yml publishes with, so the demo is the artifact the gate
      # proved.
      - uses: ./.github/actions/wasm-build
        with:
          web: build

      - name: Assemble the static site (index.html + icons + _headers + dist/ + pkg/)
        working-directory: crates/bdinfo-rs-wasm/web
        shell: pwsh
        run: |
          $site = 'site'
          if (Test-Path $site) { Remove-Item -Recurse -Force $site }
          New-Item -ItemType Directory -Path $site | Out-Null
          Copy-Item index.html $site/
          Copy-Item favicon-32.png $site/
          Copy-Item apple-touch-icon.png $site/
          Copy-Item _headers $site/
          Copy-Item -Recurse dist $site/dist
          Copy-Item -Recurse pkg $site/pkg
          Get-ChildItem -Recurse $site | ForEach-Object { $_.FullName }

      # Pages Direct Upload of the prebuilt site/. wrangler reads the token +
      # account id from the env below. --branch=master makes this the production
      # deployment (the project's production branch must be `master`).
      - name: Deploy to Cloudflare Pages (Direct Upload)
        working-directory: crates/bdinfo-rs-wasm/web
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          WRANGLER: ${{ steps.pins.outputs.WRANGLER }}
        run: npx --yes "wrangler@$WRANGLER" pages deploy site --project-name=bdinfo-rs --branch=master