name: deploy

on:
  push:
    branches: [main, dev]
  workflow_dispatch:

concurrency:
  group: deploy-${{ github.ref_name == 'main' && 'production' || 'staging' }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  deploy:
    # workflow_dispatch can target any branch; only main and dev may deploy.
    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment:
      name: ${{ github.ref_name == 'main' && 'production' || 'staging' }}
      url: ${{ github.ref_name == 'main' && 'https://tranzfer.app' || 'https://staging.tranzfer.app' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: voidzero-dev/setup-vp@d5616419e3a9637febec6da1475cee9d07a317fd # v1.20.0
        with:
          node-version: "24"
          cache: true
      - run: vp check
      - name: Deploy production
        if: github.ref == 'refs/heads/main'
        run: vp run deploy
        env:
          APP_URL: https://tranzfer.app
          BETTER_AUTH_SECRET: ${{ secrets.BETTER_AUTH_SECRET }}
          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
          POLAR_ACCESS_TOKEN: ${{ secrets.POLAR_ACCESS_TOKEN }}
          AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }}
          AXIOM_ORG_ID: ${{ secrets.AXIOM_ORG_ID }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
      - name: Deploy staging
        if: github.ref == 'refs/heads/dev'
        run: vp run --filter @tranzfer/infra deploy:staging
        env:
          TEST_LOGIN_KEY: ${{ secrets.TEST_LOGIN_KEY }}
          POLAR_SANDBOX_ACCESS_TOKEN: ${{ secrets.POLAR_SANDBOX_ACCESS_TOKEN }}
          AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }}
          AXIOM_ORG_ID: ${{ secrets.AXIOM_ORG_ID }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
      - name: Health check production
        if: github.ref == 'refs/heads/main'
        run: curl -fsS --retry 10 --retry-all-errors --retry-delay 6 https://tranzfer.app/health | jq -e '.ok'
      - name: Health check staging
        if: github.ref == 'refs/heads/dev'
        run: curl -fsS --retry 10 --retry-all-errors --retry-delay 6 https://staging.tranzfer.app/health | jq -e '.ok'