deploy.yml

# =============================================================
# ClearVoice — GitHub Actions Deployment Workflow
#
# This workflow injects your API key from GitHub Secrets at
# build time, then deploys the site to GitHub Pages.
#
# HOW TO SET UP:
# 1. Go to your repo → Settings → Secrets and variables → Actions
# 2. Click "New repository secret"
# 3. Name: CLEARVOICE_API_KEY  |  Value: your Anthropic API key
# 4. Optionally add: CLEARVOICE_MODEL (default: claude-sonnet-4-5-20250929)
# 5. Push to main or trigger manually via "Run workflow"
#
# SECURITY NOTE:
# The injected key will exist in the deployed GitHub Pages files.
# This is acceptable for personal/private projects, but be aware
# the key could be read by anyone who inspects your site's JS source.
# For team use, consider a backend proxy instead.
# =============================================================

name: Deploy ClearVoice to GitHub Pages

on:
  push:
    branches: [main]
  workflow_dispatch:   # Allow manual trigger from the Actions tab

permissions:
  contents: read
  pages: write
  id-token: write

# Only one deployment runs at a time
concurrency:
  group: "pages"
  cancel-in-progress: false

jobs:
  # ── Build ────────────────────────────────────────────────
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Generate js/config.js with injected secrets
        env:
          CV_API_KEY : ${{ secrets.CLEARVOICE_API_KEY }}
          CV_PROVIDER: ${{ vars.CLEARVOICE_PROVIDER }}
          CV_MODEL   : ${{ vars.CLEARVOICE_MODEL }}
        # Python is used for safe JSON string encoding of the API key
        # (handles special characters like $, ", \, etc.)
        run: |
          python3 - <<'PYEOF'
          import os, json

          api_key  = os.environ.get("CV_API_KEY",  "")
          provider = os.environ.get("CV_PROVIDER", "claude") or "claude"
          model    = os.environ.get("CV_MODEL",    "claude-sonnet-4-5-20250929") or "claude-sonnet-4-5-20250929"

          content = f"""// Auto-generated by GitHub Actions — DO NOT EDIT
// Regenerated on every push to main.
// To update: change the CLEARVOICE_API_KEY secret in repository settings.
window.CV_CONFIG = {{
  apiKey  : {json.dumps(api_key)},
  provider: {json.dumps(provider)},
  model   : {json.dumps(model)},
}};
"""
          with open("js/config.js", "w") as f:
              f.write(content)

          if api_key:
              print("✅ API key injected into js/config.js")
          else:
              print("⚠️  No CLEARVOICE_API_KEY secret found — deploying without key (users will configure manually)")
          PYEOF

      - name: Setup GitHub Pages
        uses: actions/configure-pages@v4

      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: "."

  # ── Deploy ───────────────────────────────────────────────
  deploy:
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4