deploy-workers.yml

name: Deploy Cloudflare Workers

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      worker:
        description: 'Worker folder to deploy (e.g. services/app-builder)'
        required: true
        type: choice
        options:
          - services/cloud-agent
          - services/cloud-agent-next
          - services/ai-attribution
          - services/app-builder
          - services/auto-fix-infra
          - services/auto-triage-infra
          - services/code-review-infra
          - services/db-proxy
          - services/deploy-infra/builder
          - services/deploy-infra/dispatcher
          - services/git-token-service
          - services/gmail-push
          - services/images-mcp
          - services/kiloclaw-billing
          - services/o11y
          - services/security-auto-analysis
          - services/security-sync
          - services/session-ingest
          - services/webhook-agent-ingest

permissions:
  contents: read

concurrency:
  group: deploy-workers-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # ── Manual dispatch: deploy a single specified worker ──────────────────────
  deploy-manual:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    name: Deploy ${{ inputs.worker }}
    steps:
      - name: Checkout code
        uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        working-directory: ${{ inputs.worker }}
        run: pnpm install --frozen-lockfile

      - name: Deploy to Cloudflare Workers
        uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3.14.1
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          workingDirectory: ${{ inputs.worker }}
          command: deploy

  # ── Push to main: detect changed workers, deploy each one ─────────────────
  detect-changes:
    if: github.event_name == 'push'
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 5
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout code
        uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1
        with:
          fetch-depth: 0

      - name: Find changed workers
        id: set-matrix
        run: |
          # All deployable workers (folders containing wrangler.jsonc).
          # kiloclaw is excluded — it has a custom Docker-based deploy in deploy-production.yml.
          # builder-docker-container is excluded — it is a build artifact, not a deployable worker.
          #
          # Diff against the SHA before the push so that multi-commit pushes
          # (e.g. a merge commit that squashes several commits) don't miss workers
          # that were only touched in earlier commits of the same push.
          BASE_SHA="${{ github.event.before }}"
          WORKERS=(
            services/cloud-agent
            services/cloud-agent-next
            services/ai-attribution
            services/app-builder
            services/auto-fix-infra
            services/auto-triage-infra
            services/code-review-infra
            services/db-proxy
            services/deploy-infra/builder
            services/deploy-infra/dispatcher
            services/git-token-service
            services/gmail-push
            services/images-mcp
            services/kiloclaw-billing
            services/o11y
            services/security-auto-analysis
            services/security-sync
            services/session-ingest
            services/webhook-agent-ingest
          )

          CHANGED=()
          for dir in "${WORKERS[@]}"; do
            if git diff --name-only "$BASE_SHA" HEAD -- "$dir/" | grep -q .; then
              CHANGED+=("$dir")
            fi
          done

          if [ ${#CHANGED[@]} -eq 0 ]; then
            echo "matrix=[]" >> "$GITHUB_OUTPUT"
          else
            MATRIX=$(printf '%s\n' "${CHANGED[@]}" | jq -R . | jq -sc .)
            echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"
          fi

  deploy-changed:
    needs: detect-changes
    if: needs.detect-changes.outputs.matrix != '[]' && needs.detect-changes.outputs.matrix != ''
    runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        worker: ${{ fromJson(needs.detect-changes.outputs.matrix) }}
    name: Deploy ${{ matrix.worker }}
    steps:
      - name: Checkout code
        uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        working-directory: ${{ matrix.worker }}
        run: pnpm install --frozen-lockfile

      - name: Deploy to Cloudflare Workers
        uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3.14.1
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          workingDirectory: ${{ matrix.worker }}
          command: deploy