deploy-reader.yml

name: Publish immutable Reader

on:
  workflow_dispatch:
    inputs:
      source_sha:
        description: Full 40-character source commit, reachable from main.
        required: true
        type: string
      target:
        description: Reader target; dispatch this workflow on main.
        required: true
        default: staging
        type: choice
        options:
          - staging
          - production
      drill:
        description: Deliberately fail smoke after uploading the already-live production source (manual only).
        type: boolean
        default: false

permissions:
  actions: read
  contents: read

concurrency:
  group: reader-pages-${{ github.event_name == 'workflow_dispatch' && inputs.target || github.ref }}
  cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }}

# CI is ci.yml. Ops and direct operators dispatch this immutable publisher.
jobs:
  admit:
    # Validate dispatch shape before acquiring an environment.
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    timeout-minutes: 3
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false
      - env:
          TARGET: ${{ inputs.target }}
          SOURCE_SHA: ${{ inputs.source_sha }}
          GITHUB_TOKEN: ${{ github.token }}
          DRILL: ${{ inputs.drill && 'true' || 'false' }}
        run: |
          set -euo pipefail
          case "$TARGET" in staging|production) ;; *) exit 1 ;; esac
          [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]
          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
          [[ "$GITHUB_REF" == refs/heads/main ]]
          node scripts/publisher/refs.mjs
          node scripts/publisher/drill.mjs admit

  inputs:
    needs: admit
    runs-on: ubuntu-24.04
    timeout-minutes: 3
    environment: reader-${{ inputs.target }}
    outputs:
      trust: ${{ steps.hashes.outputs.trust }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false
      - name: Workflow-owned ancestry check before reading environment inputs
        env:
          TARGET: ${{ inputs.target }}
          SOURCE_SHA: ${{ inputs.source_sha }}
          GITHUB_TOKEN: ${{ github.token }}
        run: node scripts/publisher/refs.mjs
      - id: hashes
        env:
          READER_TRUST_ASSET_SHA256: ${{ vars.READER_TRUST_ASSET_SHA256 }}
        run: |
          set -euo pipefail
          [[ "$READER_TRUST_ASSET_SHA256" =~ ^[0-9a-f]{64}$ ]]
          printf 'trust=%s\n' "$READER_TRUST_ASSET_SHA256" >> "$GITHUB_OUTPUT"

  build:
    name: Unprivileged frozen Reader build
    needs: inputs
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    # No GitHub environment or Cloudflare secrets. Original intake before hooks.
    defaults:
      run:
        working-directory: candidate
    env:
      TARGET: ${{ inputs.target }}
      SOURCE_SHA: ${{ inputs.source_sha }}
      # Public build inputs: Pages runtime variables do not configure Vite assets.
      VITE_MDBASE_FEEDBACK_URL: ${{ inputs.target == 'production' && 'https://feedback-api.mdbase.dev/v1/feedback' || 'https://feedback-api-staging.mdbase.dev/v1/feedback' }}
      VITE_MDBASE_FEEDBACK_TURNSTILE_SITE_KEY: ${{ inputs.target == 'production' && '0x4AAAAAAEboz_mLT-taI3H-' || '0x4AAAAAAEbkvA4d9vQJq2D1' }}
      READER_TRUST_ASSET_SHA256: ${{ needs.inputs.outputs.trust }}
      READER_SOURCE_ROOT: ${{ github.workspace }}/candidate
    outputs:
      artifact-id: ${{ steps.artifact.outputs.artifact-id }}
      artifact-digest: ${{ steps.artifact.outputs.artifact-digest }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          path: publisher
          fetch-depth: 0
          persist-credentials: false
      - name: Workflow-owned ancestry check before candidate checkout or execution
        working-directory: publisher
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: node scripts/publisher/refs.mjs
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.source_sha }}
          path: candidate
          fetch-depth: 0
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.7.0
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
      - name: Data-only original intake before dependency execution
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/reader-build"
          node ../publisher/scripts/publisher/publisher.mjs guard > "$RUNNER_TEMP/reader-build/plan.json"
      - run: node ../publisher/scripts/publisher/install-inputs.mjs "$RUNNER_TEMP/reader-build/plan.json"
        env:
          GITHUB_TOKEN: ${{ github.token }}
      - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
      - name: ALL installed original members, then unprivileged build once
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: node ../publisher/scripts/publisher/build.mjs "$RUNNER_TEMP/reader-build"
      - run: node ../publisher/scripts/publisher/envelope.mjs "$RUNNER_TEMP/reader-build"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        id: artifact
        with:
          name: reader-build-${{ inputs.target }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/reader-build/
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 90
      - name: Retain failed build plan without manufacturing a successful artifact
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: reader-build-failure-${{ inputs.target }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/reader-build/
          include-hidden-files: true
          if-no-files-found: warn
          retention-days: 90

  publish:
    name: Protected immutable Reader upload
    needs: [inputs, build]
    outputs:
      ready: ${{ steps.compatibility.outputs.ready }}
    runs-on: ubuntu-24.04
    # Upload has a separate 7-minute bound; leave time for checks and recovery.
    timeout-minutes: 60
    defaults:
      run:
        working-directory: publisher
    concurrency:
      group: reader-upload-${{ inputs.target }}
      cancel-in-progress: false
    # External environment policy admits main without per-publish approval.
    environment:
      name: reader-${{ inputs.target }}
      url: ${{ inputs.target == 'production' && 'https://reader.mdbase.dev/' || 'https://staging.mdbase-reader.pages.dev/' }}
    env:
      TARGET: ${{ inputs.target }}
      SOURCE_SHA: ${{ inputs.source_sha }}
      READER_TRUST_ASSET_SHA256: ${{ vars.READER_TRUST_ASSET_SHA256 }}
      ARTIFACT_ID: ${{ needs.build.outputs.artifact-id }}
      ARTIFACT_DIGEST: ${{ needs.build.outputs.artifact-digest }}
      READER_SOURCE_ROOT: ${{ github.workspace }}/candidate
      WRANGLER_SEND_METRICS: "false"
    steps:
      # A recovery point must predate everything its run published.
      - name: One publication per run; dispatch a new run to retry
        timeout-minutes: 1
        working-directory: ${{ github.workspace }}
        run: test "$GITHUB_RUN_ATTEMPT" = 1
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          path: publisher
          fetch-depth: 0
          persist-credentials: false
        timeout-minutes: 3
      - name: Workflow-owned ancestry check before candidate data is read
        timeout-minutes: 1
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: node scripts/publisher/refs.mjs
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.source_sha }}
          path: candidate
          fetch-depth: 0
          persist-credentials: false
        timeout-minutes: 3
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
        timeout-minutes: 2
      - name: Workflow-owned guard; candidate is data only
        timeout-minutes: 7
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/reader-receipt" "$RUNNER_TEMP/reader-upload"
          node scripts/publisher/publisher.mjs guard > "$RUNNER_TEMP/reader-receipt/plan.json"
      - name: Isolated official tool lock only; no app hooks
        timeout-minutes: 3
        run: node scripts/publisher/tool.mjs "$RUNNER_TEMP/reader-tool-path"
      - name: Immutable artifact identity and full original inventory
        timeout-minutes: 4
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          node scripts/publisher/artifact.mjs "$RUNNER_TEMP/reader-upload/artifact"
          cp "$RUNNER_TEMP/reader-upload/artifact/"{inventory.json,envelope.json} "$RUNNER_TEMP/reader-receipt/"
          cp "$RUNNER_TEMP/reader-upload/artifact-metadata.json" "$RUNNER_TEMP/reader-receipt/"
          cmp "$RUNNER_TEMP/reader-receipt/plan.json" "$RUNNER_TEMP/reader-upload/artifact/plan.json"
          node scripts/publisher/publisher.mjs inventory "$RUNNER_TEMP/reader-upload/artifact/publish" "$RUNNER_TEMP/reader-receipt/plan.json" > "$RUNNER_TEMP/reader-receipt/revalidated-inventory.json"
          cmp "$RUNNER_TEMP/reader-receipt/inventory.json" "$RUNNER_TEMP/reader-receipt/revalidated-inventory.json"
          chmod -R a-w "$RUNNER_TEMP/reader-upload/artifact"
      - name: Source-owned capture Functions upload configuration
        timeout-minutes: 1
        run: node scripts/publisher/runtime.mjs upload-config "$RUNNER_TEMP/reader-upload"
      - name: Existing project identity (never provision)
        timeout-minutes: 1
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: node scripts/publisher/publisher.mjs project > "$RUNNER_TEMP/reader-receipt/project.json"
      - name: Live production contains the authenticated SDK producer
        id: compatibility
        timeout-minutes: 2
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: node scripts/publisher/compatibility.mjs "$RUNNER_TEMP/reader-receipt/plan.json" "$RUNNER_TEMP/reader-receipt/compatibility.json"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        timeout-minutes: 2
        with:
          name: reader-compatibility-${{ inputs.target }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/reader-receipt/compatibility.json
          if-no-files-found: error
          retention-days: 90
      - name: Capture production recovery point before upload
        if: steps.compatibility.outputs.ready == 'true'
        timeout-minutes: 4
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: node scripts/publisher/rollback.mjs snapshot "$RUNNER_TEMP/reader-receipt"
      # Stored before upload, so recovery survives a lost job or receipt.
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: inputs.target == 'production' && steps.compatibility.outputs.ready == 'true'
        timeout-minutes: 2
        with:
          name: reader-production-recovery-point-${{ github.run_id }}
          path: ${{ runner.temp }}/reader-receipt/previous.json
          if-no-files-found: error
          retention-days: 90
      - name: Drill requires the exact source already live before upload
        if: inputs.drill && steps.compatibility.outputs.ready == 'true'
        timeout-minutes: 1
        env:
          DRILL: ${{ inputs.drill && 'true' || 'false' }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: node scripts/publisher/drill.mjs before-upload "$RUNNER_TEMP/reader-receipt"
      - name: Recheck immutable inventory and upload once
        id: upload
        if: steps.compatibility.outputs.ready == 'true'
        timeout-minutes: 7
        env:
          GITHUB_TOKEN: ${{ github.token }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          set -euo pipefail
          node scripts/publisher/refs.mjs
          branch=$(jq -er .pagesBranch "$RUNNER_TEMP/reader-receipt/plan.json")
          node scripts/publisher/publisher.mjs assert-inventory "$RUNNER_TEMP/reader-upload/artifact/publish" "$RUNNER_TEMP/reader-receipt/inventory.json"
          cli=$(cat "$RUNNER_TEMP/reader-tool-path")
          cd "$RUNNER_TEMP/reader-upload"
          node "$cli" pages deploy artifact/publish --no-bundle --project-name mdbase-reader --branch "$branch" --commit-hash "$SOURCE_SHA" --commit-dirty=false > "$RUNNER_TEMP/reader-upload/wrangler-output.txt" 2>&1
      - name: Resolve actual full deployment UUID before served checks
        id: deployment
        timeout-minutes: 1
        if: always() && steps.compatibility.outputs.ready == 'true' && (steps.upload.outcome == 'success' || steps.upload.outcome == 'failure' || steps.upload.outcome == 'cancelled')
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: node scripts/publisher/publisher.mjs capture "$RUNNER_TEMP/reader-upload/wrangler-output.txt" > "$RUNNER_TEMP/reader-receipt/deployment.json"
      - name: All deployment URL AND alias bytes, source-owned headers and routes
        id: verification
        timeout-minutes: 9
        if: always() && steps.compatibility.outputs.ready == 'true' && steps.deployment.outcome == 'success'
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          DRILL: ${{ inputs.drill && 'true' || 'false' }}
        run: |
          set -euo pipefail
          node scripts/publisher/hosting.mjs "$RUNNER_TEMP/reader-receipt/plan.json" "$RUNNER_TEMP/reader-receipt/inventory.json" "$RUNNER_TEMP/reader-receipt/deployment.json" "$RUNNER_TEMP/reader-upload/artifact" > "$RUNNER_TEMP/reader-receipt/verification.json"
          if [ "$DRILL" = true ]; then node scripts/publisher/drill.mjs uploaded "$RUNNER_TEMP/reader-receipt"; fi
      - name: Preserve honest failure or complete static-publication receipt
        timeout-minutes: 1
        if: always() && steps.compatibility.outputs.ready == 'true'
        run: |
          if [ -f "$RUNNER_TEMP/reader-upload/artifact-metadata.json" ]; then cp "$RUNNER_TEMP/reader-upload/artifact-metadata.json" "$RUNNER_TEMP/reader-receipt/"; fi
          node scripts/publisher/publisher.mjs receipt "$RUNNER_TEMP/reader-receipt" > "$RUNNER_TEMP/reader-receipt/receipt.json"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        timeout-minutes: 2
        if: always()
        with:
          name: reader-receipt-${{ inputs.target }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/reader-receipt/
          include-hidden-files: true
          if-no-files-found: warn
          retention-days: 90

  smoke:
    name: Reader fresh-browser smoke
    needs: publish
    if: needs.publish.outputs.ready == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    # No environment, Cloudflare credentials, candidate checkout or app install.
    env:
      SOURCE_SHA: ${{ inputs.source_sha }}
      TARGET: ${{ inputs.target }}
      PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.reader-smoke-browsers
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
      - name: Isolated pinned browser tool with install scripts disabled
        timeout-minutes: 15
        run: |
          set -euo pipefail
          node scripts/publisher/tool.mjs "$RUNNER_TEMP/reader-smoke-tool" smoke
          module=$(cat "$RUNNER_TEMP/reader-smoke-tool")
          node "$(dirname "$module")/cli.js" install --with-deps chromium
      - name: Fresh load, source entry asset, readiness and sign-in
        timeout-minutes: 3
        run: node scripts/publisher/smoke.mjs "$RUNNER_TEMP/reader-smoke-tool" "$RUNNER_TEMP/reader-smoke.json"
      - name: Read this run's verified upload receipt for the manual drill
        if: inputs.drill && inputs.target == 'production' && github.event_name == 'workflow_dispatch'
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" --name "reader-receipt-production-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" --dir "$RUNNER_TEMP/reader-drill"
      - name: Deliberate smoke failure after real same-source production upload
        if: inputs.drill && inputs.target == 'production' && github.event_name == 'workflow_dispatch'
        env:
          DRILL: ${{ inputs.drill && 'true' || 'false' }}
        run: node scripts/publisher/drill.mjs fail "$RUNNER_TEMP/reader-drill" "$RUNNER_TEMP/reader-drill.json"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always() && inputs.drill
        with:
          name: reader-production-drill-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/reader-drill.json
          if-no-files-found: warn
          retention-days: 90
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: always()
        with:
          name: reader-${{ inputs.target }}-smoke-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/reader-smoke.json
          if-no-files-found: warn
          retention-days: 90

  production-recovery:
    name: Restore production after incomplete publication or smoke
    needs: [publish, smoke]
    # A job-level always() still runs after cancellation or a job timeout.
    if: always() && inputs.target == 'production' && needs.publish.result != 'skipped' && needs.smoke.result != 'success' && needs.publish.outputs.ready != 'false'
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    environment: reader-production
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false
        timeout-minutes: 3
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
        timeout-minutes: 2
      - name: Find the recovery point stored before upload
        id: point
        timeout-minutes: 1
        env:
          GH_TOKEN: ${{ github.token }}
          DEPLOY_RESULT: ${{ needs.publish.result }}
        run: |
          set -euo pipefail
          id=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?name=reader-production-recovery-point-$GITHUB_RUN_ID" --jq '[.artifacts[]|select(.expired|not)]|first|.id // empty')
          if [ -z "$id" ] && [ "$DEPLOY_RESULT" = success ]; then
            echo 'A completed publication has no recovery point' >&2
            exit 1
          fi
          echo "artifact-id=$id" >> "$GITHUB_OUTPUT"
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        if: steps.point.outputs.artifact-id != ''
        timeout-minutes: 2
        with:
          artifact-ids: ${{ steps.point.outputs.artifact-id }}
          path: ${{ runner.temp }}/reader-recovery
          merge-multiple: true
      - name: Restore snapshot and verify every previous asset; keep run failed
        if: steps.point.outputs.artifact-id != ''
        timeout-minutes: 7
        env:
          SOURCE_SHA: ${{ inputs.source_sha }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: node scripts/publisher/rollback.mjs recover "$RUNNER_TEMP/reader-recovery"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        timeout-minutes: 2
        if: always() && steps.point.outputs.artifact-id != ''
        with:
          name: reader-production-recovery-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/reader-recovery/
          if-no-files-found: warn
          retention-days: 90