name: deploy

# Deploys the legacy Worker and the data site (site, OG Worker, sync Workflow).

#

# Each service is split in two:

# - build runs repository code (bun install, cf build / bun script/build.ts) with

# no environment, no secrets and no OIDC token, and uploads the resolved Build

# Output with a SHA256SUMS whose digest it reports.

# - deploy runs in the dev|production environment and mints a short-lived

# Cloudflare token from the token issuer. It checks out only .github/release/,

# verifies the artifact against the digest the build job reported, installs

# the cf CLI pinned in .github/release/cf, and runs only

# .github/release/deploy-legacy.sh or deploy-data.sh. Those treat the artifact

# as data and refuse anything but the pinned targets in

# .github/release/targets/. That is what makes an account-wide token safe: the

# data sync Workflow PUT has no per-Worker permission, so only Dax-reviewed

# .github code ever holds a token that can write another Worker.

on:

push:

branches:

- dev

- production

workflow_dispatch:

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:

contents: read

jobs:

legacy-build:

if: github.repository == 'anomalyco/opencode' && (github.ref_name == 'dev' || github.ref_name == 'production')

runs-on: blacksmith-4vcpu-ubuntu-2404

outputs:

digest: ${{ steps.upload.outputs.digest }}

steps:

- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

with:

ref: ${{ github.sha }}

persist-credentials: false

- uses: ./.github/actions/setup-bun

- name: Build

working-directory: services/legacy

run: ./node_modules/.bin/cf build --mode ${{ github.ref_name }}

- id: upload

uses: ./.github/release/upload

with:

name: legacy-${{ github.ref_name }}

path: services/legacy/.cloudflare/output

retention-days: 7

include-hidden-files: true

legacy-deploy:

needs: legacy-build

if: github.repository == 'anomalyco/opencode' && (github.ref_name == 'dev' || github.ref_name == 'production')

runs-on: blacksmith-4vcpu-ubuntu-2404

environment: ${{ github.ref_name }}

permissions:

contents: read

id-token: write

steps:

- name: Check out the deploy scripts

uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

with:

ref: ${{ github.sha }}

sparse-checkout: /.github/release/

sparse-checkout-cone-mode: false

persist-credentials: false

- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

with:

node-version: "24"

- name: Install the pinned cf CLI

working-directory: .github/release/cf

run: npm ci --ignore-scripts --no-audit --no-fund

- name: Download

uses: ./.github/release/download

with:

pattern: legacy-${{ github.ref_name }}

require-digests: true

digests: legacy-${{ github.ref_name }}=${{ needs.legacy-build.outputs.digest }}

- name: Configure AWS credentials

uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0

with:

role-to-assume: arn:aws:iam::604439173067:role/github/opencode-${{ github.ref_name }}

role-session-name: opencode-${{ github.run_id }}

aws-region: us-east-1

# A 15-minute token for this stage, minted by the token issuer (anomalyco/secrets) from the role above.

# It is a step output, so only the Deploy step gets it.

- name: Cloudflare token

id: cloudflare-token

run: bash .github/release/cloudflare-token.sh "$GITHUB_REF_NAME"

env:

CLOUDFLARE_TOKEN_URL: ${{ vars.CLOUDFLARE_TOKEN_URL }}

# The GitHub App secrets are read here, so only this step ever has them. They reach cf through a file in the

# runner's temp directory, never argv, and the file is removed when the step ends.

- name: Deploy

env:

STAGE: ${{ github.ref_name }}

CLOUDFLARE_API_TOKEN: ${{ steps.cloudflare-token.outputs.token }}

# An explicit bash runs with pipefail, so a failed secret read fails the step.

shell: bash

run: |

if [[ "$STAGE" == dev ]]; then

exec bash .github/release/deploy-legacy.sh dev "$RUNNER_TEMP/in/legacy-dev"

fi

umask 077

secrets="$RUNNER_TEMP/legacy-secrets.json"

trap 'rm -f "$secrets"' EXIT

for name in GITHUB_APP_ID GITHUB_APP_PRIVATE_KEY; do

aws secretsmanager get-secret-value --secret-id "opencode/production/$name" --output json |

jq --arg name "$name" '{($name): .SecretString}'

done | jq -s add > "$secrets"

bash .github/release/deploy-legacy.sh "$STAGE" "$RUNNER_TEMP/in/legacy-$STAGE" "$secrets"

data-build:

if: github.repository == 'anomalyco/opencode' && (github.ref_name == 'dev' || github.ref_name == 'production')

runs-on: blacksmith-4vcpu-ubuntu-2404

outputs:

digest: ${{ steps.upload.outputs.digest }}

steps:

- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

with:

ref: ${{ github.sha }}

persist-credentials: false

- uses: ./.github/actions/setup-bun

- name: Build

working-directory: services/data

run: bun script/build.ts --mode ${{ github.ref_name }}

- id: upload

uses: ./.github/release/upload

with:

name: data-${{ github.ref_name }}

path: services/data/.cloudflare/output

retention-days: 7

include-hidden-files: true

# The /data site, its OG image Worker and the sync Workflow (services/data).

data-deploy:

needs: data-build

if: github.repository == 'anomalyco/opencode' && (github.ref_name == 'dev' || github.ref_name == 'production')

runs-on: blacksmith-4vcpu-ubuntu-2404

environment: ${{ github.ref_name }}

permissions:

contents: read

id-token: write

steps:

- name: Check out the deploy scripts

uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

with:

ref: ${{ github.sha }}

sparse-checkout: /.github/release/

sparse-checkout-cone-mode: false

persist-credentials: false

- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

with:

node-version: "24"

- name: Install the pinned cf CLI

working-directory: .github/release/cf

run: npm ci --ignore-scripts --no-audit --no-fund

- name: Download

uses: ./.github/release/download

with:

pattern: data-${{ github.ref_name }}

require-digests: true

digests: data-${{ github.ref_name }}=${{ needs.data-build.outputs.digest }}

- name: Configure AWS credentials

uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0

with:

role-to-assume: arn:aws:iam::604439173067:role/github/opencode-${{ github.ref_name }}

role-session-name: opencode-${{ github.run_id }}

aws-region: us-east-1

- name: Cloudflare token

id: cloudflare-token

run: bash .github/release/cloudflare-token.sh "$GITHUB_REF_NAME"

env:

CLOUDFLARE_TOKEN_URL: ${{ vars.CLOUDFLARE_TOKEN_URL }}

# The Workers' secrets are read here, so only this step ever has them. They reach cf through files in the

# runner's temp directory, never argv, and are removed when the step ends.

- name: Deploy

env:

STAGE: ${{ github.ref_name }}

CLOUDFLARE_API_TOKEN: ${{ steps.cloudflare-token.outputs.token }}

# An explicit bash runs with pipefail, so a failed secret read fails the step.

shell: bash

run: |

umask 077

secrets="$RUNNER_TEMP/data-secrets.json"

trap 'rm -f "$secrets" "$secrets".*' EXIT

for name in DATA_DATABASE_HOST DATA_DATABASE_USERNAME DATA_DATABASE_PASSWORD R2_SQL_AUTH_TOKEN DATA_HIDDEN_MODELS; do

aws secretsmanager get-secret-value --secret-id "opencode/$STAGE/$name" --output json |

jq --arg name "$name" '{($name): .SecretString}'

done | jq -s add > "$secrets"

bash .github/release/deploy-data.sh "$STAGE" "$RUNNER_TEMP/in/data-$STAGE" "$secrets"