deploy-docs.yml

name: Deploy Documentation to Cloudflare Pages

on:
  push:
    branches:
      - main
      - develop
    paths:
      - 'docs/**'
      - '.github/workflows/deploy-docs.yml'
  pull_request:
    branches:
      - main
      - develop
    paths:
      - 'docs/**'
  workflow_dispatch:
    inputs:
      environment:
        description: 'Deployment environment'
        required: true
        default: 'preview'
        type: choice
        options:
          - preview
          - production

env:
  MDBOOK_VERSION: '0.4.40'
  # 1Password secret references
  OP_API_TOKEN: op://TerraphimPlatform/terraphim-md-book-cloudflare/workers-api-token
  OP_ACCOUNT_ID: op://TerraphimPlatform/terraphim-md-book-cloudflare/account-id
  OP_ZONE_ID: op://TerraphimPlatform/terraphim-md-book-cloudflare/zone-id

jobs:
  build:
    name: Build Documentation
    runs-on: [self-hosted, linux, x64]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup mdBook
        uses: peaceiris/actions-mdbook@v2
        with:
          mdbook-version: ${{ env.MDBOOK_VERSION }}

      - name: Install mdBook preprocessors
        run: |
          cargo install mdbook-mermaid --locked
          mdbook-mermaid install docs/

      - name: Build documentation
        working-directory: docs
        run: mdbook build

      - name: Upload build artifact
        uses: actions/upload-artifact@v4
        with:
          name: docs-build
          path: docs/book/
          retention-days: 7

  deploy-preview:
    name: Deploy Preview
    needs: build
    if: github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'preview')
    runs-on: [self-hosted, linux, x64]
    permissions:
      contents: read
      deployments: write
      pull-requests: write
      id-token: write
    environment:
      name: docs-preview
      url: ${{ steps.deploy.outputs.deployment-url }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Download build artifact
        uses: actions/download-artifact@v4
        with:
          name: docs-build
          path: docs/book/

      - name: Load secrets from 1Password
        id: op-load-secrets
        uses: 1password/load-secrets-action@v2
        with:
          export-env: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          CLOUDFLARE_API_TOKEN: ${{ env.OP_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ env.OP_ACCOUNT_ID }}

      - name: Deploy to Cloudflare Pages (Preview)
        id: deploy
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ env.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ env.CLOUDFLARE_ACCOUNT_ID }}
          command: pages deploy docs/book --project-name=terraphim-docs --branch=${{ github.head_ref || github.ref_name }}

      - name: Comment PR with preview URL
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const deploymentUrl = '${{ steps.deploy.outputs.deployment-url }}';
            const comment = `## Documentation Preview

            Your documentation changes have been deployed to:
            **${deploymentUrl}**

            This preview will be available until the PR is closed.`;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: comment
            });

  deploy-production:
    name: Deploy Production
    needs: build
    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'production')
    runs-on: [self-hosted, linux, x64]
    permissions:
      contents: read
      deployments: write
      id-token: write
    environment:
      name: docs-production
      url: https://docs.terraphim.ai
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Download build artifact
        uses: actions/download-artifact@v4
        with:
          name: docs-build
          path: docs/book/

      - name: Load secrets from 1Password
        id: op-load-secrets
        uses: 1password/load-secrets-action@v2
        with:
          export-env: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          CLOUDFLARE_API_TOKEN: ${{ env.OP_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ env.OP_ACCOUNT_ID }}
          CLOUDFLARE_ZONE_ID: ${{ env.OP_ZONE_ID }}

      - name: Deploy to Cloudflare Pages (Production)
        id: deploy
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ env.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ env.CLOUDFLARE_ACCOUNT_ID }}
          command: pages deploy docs/book --project-name=terraphim-docs --branch=main --commit-dirty=true

      - name: Deployment Summary
        run: |
          echo "## Deployment Complete" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Documentation has been deployed to:" >> $GITHUB_STEP_SUMMARY
          echo "- **Production URL**: https://docs.terraphim.ai" >> $GITHUB_STEP_SUMMARY
          echo "- **Cloudflare Pages URL**: ${{ steps.deploy.outputs.deployment-url }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Commit**: ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
          echo "**Triggered by**: @${{ github.actor }}" >> $GITHUB_STEP_SUMMARY

  # Optional: Purge CDN cache after production deployment
  purge-cache:
    name: Purge CDN Cache
    needs: deploy-production
    runs-on: [self-hosted, linux, x64]
    permissions:
      id-token: write
    steps:
      - name: Load secrets from 1Password
        id: op-load-secrets
        uses: 1password/load-secrets-action@v2
        with:
          export-env: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          CLOUDFLARE_API_TOKEN: ${{ env.OP_API_TOKEN }}
          CLOUDFLARE_ZONE_ID: ${{ env.OP_ZONE_ID }}

      - name: Purge Cloudflare Cache
        run: |
          curl -X POST "https://api.cloudflare.com/client/v4/zones/${CLOUDFLARE_ZONE_ID}/purge_cache" \
            -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" \
            -H "Content-Type: application/json" \
            --data '{"purge_everything":true}' || true