shared-deploy.yml

# The "Shared Deploy" workflow deploys the application to Vercel, either in production or preview mode based on the
# `prod` input. It retrieves the build artifacts, prepares secrets, bundles the Vercel application, and deploys it.
# If a custom domain is specified, it assigns the deployment URL to that domain.

name: App Shared Deploy

on:
  workflow_call:
    inputs:
      domain:
        description: "Assign the new deployment URL to the specified input when set"
        required: false
        type: string
      env:
        description: "Environment to get the Github secrets and variables from"
        required: true
        type: string
      ref:
        description: "The branch, tag or SHA to checkout"
        required: false
        type: string
    outputs:
      deploymentUrl:
        description: "The URL of the Vercel deployment"
        value: ${{ jobs.deploy.outputs.deploymentUrl }}

permissions:
  contents: read

env:
  VERCEL_SCOPE: aragon-app
  VERCEL_ARGS: ${{ (inputs.env == 'production' && '--prod') || '' }}
  ENABLE_EXPERIMENTAL_COREPACK: "1"

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.env }}
    outputs:
      deploymentUrl: ${{ steps.set-deployment-url.outputs.deploymentUrl }}
    steps:
      - name: Download infra credentials
        uses: aragon/github-templates/steps/credential-retrieval@v0.4
        with:
          op-token: "${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}"
          op-vault: "kv_app_infra"

      - name: Checkout actions
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 1
          sparse-checkout: .github/actions/setup

      - name: Setup
        uses: ./.github/actions/setup
        with:
          ref: ${{ inputs.ref }}

      - name: Setup env file
        run: pnpm run setup ${{ inputs.env }}

      - name: Setup env file secrets
        uses: aragon/github-templates/steps/credential-retrieval@v0.4
        with:
          op-token: "${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}"
          op-vault: "kv_app_${{ inputs.env }}"
          secret-filepath: ".env"
          mode: alltofile

      - name: Bundle Vercel application
        run: pnpm vercel build ${{ env.VERCEL_ARGS }} --yes --token=${{ env.VERCEL_TOKEN }} --scope ${{ env.VERCEL_SCOPE }}

      - name: Deploy to Vercel
        run: pnpm vercel deploy --prebuilt ${{ env.VERCEL_ARGS }} --skip-domain --yes --token=${{ env.VERCEL_TOKEN }} --scope ${{ env.VERCEL_SCOPE }} > deployment-url.txt

      - name: Set output
        id: set-deployment-url
        run: echo "deploymentUrl=$(cat deployment-url.txt)" >> $GITHUB_OUTPUT

      - name: Set deployment alias
        if: inputs.domain != ''
        run: pnpm vercel alias ${{ steps.set-deployment-url.outputs.deploymentUrl }} ${{ inputs.domain }} --token=${{ env.VERCEL_TOKEN }} --scope ${{ env.VERCEL_SCOPE }}