name: Site

# Builds nxdns.sh and deploys it as a Cloudflare Worker serving static assets,
# configured in website/wrangler.jsonc, domain included. Cloudflare has no Gitea
# integration, so the build runs here and wrangler uploads it.
#
# The site publishes docs/ and CHANGELOG.md as they stand, and reads the release
# from build.zig.zon, so a change to any of them changes the site.
#
# Secret CLOUDFLARE_API_TOKEN: a token from the "Edit Cloudflare Workers"
# template, limited to this account and the nxdns.sh zone. Variable
# CLOUDFLARE_ACCOUNT_ID.
on:
  push:
    branches: [master]
    paths:
      - "website/**"
      - "docs/**"
      - "CHANGELOG.md"
      - "build.zig.zon"
      - ".gitea/workflows/site.yml"
  workflow_dispatch:

concurrency:
  group: site
  cancel-in-progress: false

env:
  # The newest wrangler older than npm's release-age floor on the day it was pinned.
  WRANGLER_VERSION: "4.148.0"

jobs:
  deploy:
    runs-on: ubuntu-24.04-light
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      # Node is the one the runner image puts on PATH. setup-node is not used:
      # it looks for Node in an empty tool cache and downloads it again.
      - name: Build
        working-directory: website
        run: |
          npm ci
          npm run build

      - name: Deploy
        working-directory: website
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
        run: npx --yes "wrangler@${WRANGLER_VERSION:?}" deploy --message "${GITHUB_SHA:?}"