sync-worker-cors.yml

name: Sync Worker CORS

on:
  push:
    branches: [main, develop]
    paths:
      - 'src/assistants/*/config.yaml'
      - 'scripts/sync_worker_cors.py'
      - '.github/workflows/sync-worker-cors.yml'
      - 'workers/osa-worker/**'
  pull_request:
    branches: [main, develop]
    paths:
      - 'src/assistants/*/config.yaml'
      - 'workers/osa-worker/**'
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  sync-cors:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.CI_ADMIN_TOKEN }}
          fetch-depth: 0  # Fetch full history so git diff works

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: |
          pip install pyyaml

      - name: Run CORS sync script
        run: |
          python scripts/sync_worker_cors.py

      - name: Check for changes
        id: check_changes
        run: |
          # Check if CORS sync made changes
          if git diff --quiet workers/osa-worker/index.js; then
            echo "No CORS changes detected"
            CORS_CHANGED=false
          else
            echo "CORS changes detected"
            CORS_CHANGED=true
          fi

          # Check if worker files were modified in the push that triggered this workflow
          # Use the range from the push event (before -> after)
          if [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]; then
            # Normal push (not first commit)
            if git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q "^workers/osa-worker/"; then
              echo "Worker files changed in push"
              WORKER_CHANGED=true
            else
              echo "No worker files in push"
              WORKER_CHANGED=false
            fi
          else
            # First commit to branch, check current files
            if git ls-files workers/osa-worker/ | grep -q .; then
              echo "Worker files exist (first commit)"
              WORKER_CHANGED=true
            else
              WORKER_CHANGED=false
            fi
          fi

          # Set outputs
          echo "cors_changed=$CORS_CHANGED" >> $GITHUB_OUTPUT

          # Deploy if either CORS sync changed files OR worker files were pushed
          if [ "$CORS_CHANGED" = true ] || [ "$WORKER_CHANGED" = true ]; then
            echo "changed=true" >> $GITHUB_OUTPUT
            echo "✅ Deployment needed"
          else
            echo "changed=false" >> $GITHUB_OUTPUT
            echo "No deployment needed"
          fi

      - name: Commit CORS changes (main/develop only)
        if: steps.check_changes.outputs.cors_changed == 'true' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') && github.event_name == 'push'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add workers/osa-worker/index.js
          git commit -m "chore: sync worker CORS from community configs [skip ci]"
          git pull --rebase origin ${{ github.ref_name }}
          git push

      - name: Deploy to Cloudflare Workers (production)
        if: steps.check_changes.outputs.changed == 'true' && github.ref == 'refs/heads/main' && github.event_name == 'push'
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: |
          npm install -g wrangler
          cd workers/osa-worker
          wrangler deploy
          echo "✅ Deployed to production worker"

      - name: Deploy to Cloudflare Workers (dev)
        if: steps.check_changes.outputs.changed == 'true' && github.ref == 'refs/heads/develop' && github.event_name == 'push'
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: |
          npm install -g wrangler
          cd workers/osa-worker
          wrangler deploy --env=dev
          echo "✅ Deployed to dev worker"

      - name: Comment on PR
        if: steps.check_changes.outputs.changed == 'true' && github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            let message = '<!-- worker-cors-sync -->\n';
            message += '⚠️ **Worker Deployment Required**\n\n';
            if ('${{ steps.check_changes.outputs.cors_changed }}' === 'true') {
              message += 'This PR modifies community CORS origins. ';
            }
            message += 'Worker changes detected. After merging to `main` or `develop`, the workflow will automatically deploy the worker.\n\n';
            message += '**Manual deployment (if needed):**\n```bash\ncd workers/osa-worker\nwrangler deploy --env dev  # for develop branch\nwrangler deploy            # for main branch\n```';

            // Find existing comment from this workflow
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });

            const existing = comments.find(c =>
              c.user.type === 'Bot' &&
              c.body.includes('<!-- worker-cors-sync -->')
            );

            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body: message
              });
            } else {
              await github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: message
              });
            }