name: Deploy Docs (production)

# Builds apps/docs and publishes it to the PRODUCTION Cloudflare Pages project (bloom-docs-prod).
# Manual-only, mirroring deploy-web-production.yml - production is a deliberate release, never
# automatic. The docs site is static and API-independent, so there is no origin/OAuth wiring to
# do first; the workflow is simply never dispatched until a production docs release is wanted.
#
# Like deploy-docs-dev.yml (M45-5), a misconfiguration fails loud instead of silently skipping:
# missing credentials fail the preflight step, and a missing Pages project fails the wrangler
# publish. OPERATOR STEP (one-time, needs the Cloudflare key): create the project before the
# first run - `wrangler pages project create bloom-docs-prod --production-branch=main`.

on:
  workflow_dispatch:

concurrency:
  group: deploy-docs-production
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: bloom-arc
    steps:
      - uses: actions/checkout@v4

      # Fail loud, never silently skip (M45-5). Secrets are invisible to `if:`, so the check
      # goes through env vars.
      - name: Preflight - require the Cloudflare configuration
        env:
          HAS_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN != '' }}
          HAS_ACCOUNT: ${{ vars.CLOUDFLARE_ACCOUNT_ID != '' }}
        run: |
          set -euo pipefail
          ok=true
          if [ "$HAS_TOKEN" != "true" ]; then
            echo "::error::CLOUDFLARE_API_TOKEN secret is not set - the docs deploy must not silently skip"
            ok=false
          fi
          if [ "$HAS_ACCOUNT" != "true" ]; then
            echo "::error::CLOUDFLARE_ACCOUNT_ID variable is not set - the docs deploy must not silently skip"
            ok=false
          fi
          [ "$ok" = "true" ] || exit 1

      - uses: pnpm/action-setup@v4
        with:
          version: 10.6.3

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      # Workspace-root install (single lockfile, #481); build + publish stay in apps/docs.
      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        working-directory: apps/docs
        run: pnpm run build

      - name: Publish to Cloudflare Pages (production)
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
          workingDirectory: apps/docs
          packageManager: pnpm
          command: >-
            pages deploy build
            --project-name=${{ vars.CLOUDFLARE_DOCS_PAGES_PROJECT_PROD || 'bloom-docs-prod' }}
            --branch=main