deploy-worker.yml

name: deploy-worker

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: deploy-worker
  cancel-in-progress: false

jobs:
  deploy:
    name: Deploy Worker
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"

      - name: Set up pnpm
        run: |
          corepack enable
          corepack prepare pnpm@10.23.0 --activate

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify Cloudflare token
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: |
          if [ -z "${CLOUDFLARE_API_TOKEN:-}" ]; then
            echo "::error::Set the CLOUDFLARE_API_TOKEN repository secret before deploy-worker can publish."
            exit 1
          fi

      - name: Check
        run: pnpm check

      - name: Test
        run: pnpm test

      - name: Build
        run: pnpm build

      - name: Deploy product router
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: |
          for attempt in 1 2 3; do
            pnpm deploy:product:worker && exit 0
            sleep $((attempt * 5))
          done
          pnpm deploy:product:worker

      - name: Apply D1 migrations
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: |
          for attempt in 1 2 3; do
            pnpm exec wrangler d1 migrations apply DB --remote && exit 0
            sleep $((attempt * 5))
          done
          pnpm exec wrangler d1 migrations apply DB --remote

      - name: Deploy Worker
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CRABBOX_OPENCLAW_TOKEN: ${{ secrets.CRABBOX_OPENCLAW_TOKEN }}
          CRABBOX_EMBED_TICKET_SECRET: ${{ secrets.CRABBOX_EMBED_TICKET_SECRET }}
        run: |
          set -euo pipefail
          if [ -z "${CRABBOX_EMBED_TICKET_SECRET:-}" ]; then
            echo "::error::Set CRABBOX_EMBED_TICKET_SECRET before deploying Crabfleet."
            exit 1
          fi
          if [ -z "${CRABBOX_OPENCLAW_TOKEN:-}" ]; then
            echo "::error::Set CRABBOX_OPENCLAW_TOKEN before deploying Crabfleet."
            exit 1
          fi
          runtime_token="$(
            node -e '
              const { createHmac } = require("node:crypto");
              const root = process.env.CRABBOX_OPENCLAW_TOKEN?.trim();
              if (!root) process.exit(1);
              process.stdout.write(
                createHmac("sha256", root)
                  .update("openclaw/crabbox-runtime-adapter/v1")
                  .digest("base64url"),
              );
            '
          )"
          secrets_file="$(mktemp)"
          trap 'rm -f "$secrets_file"' EXIT
          SECRETS_FILE="$secrets_file" \
            CRABBOX_RUNTIME_ADAPTER_TOKEN="$runtime_token" \
            CRABBOX_EMBED_TICKET_SECRET="$CRABBOX_EMBED_TICKET_SECRET" \
            node -e '
              const { writeFileSync } = require("node:fs");
              writeFileSync(
                process.env.SECRETS_FILE,
                JSON.stringify({
                  CRABBOX_OPENCLAW_TOKEN: process.env.CRABBOX_OPENCLAW_TOKEN,
                  CRABBOX_EMBED_TICKET_SECRET:
                    process.env.CRABBOX_EMBED_TICKET_SECRET,
                  CRABBOX_RUNTIME_ADAPTER_TOKEN:
                    process.env.CRABBOX_RUNTIME_ADAPTER_TOKEN,
                }),
              );
            '
          for attempt in 1 2 3; do
            pnpm exec wrangler deploy --secrets-file "$secrets_file" && exit 0
            sleep $((attempt * 5))
          done
          pnpm exec wrangler deploy --secrets-file "$secrets_file"

      - name: Ensure domains
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_DNS_API_TOKEN }}
        run: |
          if [ -z "${CLOUDFLARE_API_TOKEN:-}" ]; then
            echo "CLOUDFLARE_DNS_API_TOKEN is not set; skipping DNS/domain convergence."
            exit 0
          fi
          node scripts/ensure-cloudflare-domains.mjs

      - name: Verify deployment
        run: |
          set -euo pipefail
          test "$(curl --fail --silent --show-error --retry 12 --retry-all-errors --retry-delay 5 --max-time 20 https://crabfleet.openclaw.ai/healthz)" = "ok"
          test "$(curl --fail --silent --show-error --location --retry 12 --retry-all-errors --retry-delay 5 --max-time 20 --output /dev/null --write-out '%{url_effective}' https://crabfleet.ai/)" = "https://docs.crabfleet.ai/"