Repository navigation
Merge pull request #764 from CodingCatDev/fix/guest-portal-security-h… #125
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Site to Cloudflare Workers | |
| on: | |
| push: | |
| branches: [dev, main] | |
| paths: | |
| - "apps/site/**" | |
| - "packages/**" | |
| - "pnpm-lock.yaml" | |
| - ".github/workflows/deploy-workers.yml" | |
| concurrency: | |
| group: deploy-site-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| deploy-dev: | |
| if: github.ref == 'refs/heads/dev' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: ".nvmrc" | |
| cache: "pnpm" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Generate Sanity Types | |
| run: pnpm typegen | |
| env: | |
| SANITY_STUDIO_PROJECT_ID: hfh83o0w | |
| SANITY_STUDIO_DATASET: dev | |
| - name: Generate Cloudflare Types | |
| run: pnpm --filter @codingcatdev/site cf-typegen | |
| - name: Build site (dev) | |
| run: pnpm --filter @codingcatdev/site build | |
| - name: Deploy to Cloudflare Workers (dev.codingcat.dev) | |
| run: pnpm --filter @codingcatdev/site exec wrangler deploy | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| - name: Configure Cloudflare Worker Secrets (dev) | |
| run: | | |
| echo "$SANITY_API_READ_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put SANITY_API_READ_TOKEN --env="" | |
| if [ -n "$SANITY_AUTH_TOKEN" ]; then | |
| echo "$SANITY_AUTH_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put SANITY_AUTH_TOKEN --env="" | |
| fi | |
| if [ -n "$SANITY_CONTEXT_TOKEN" ]; then | |
| echo "$SANITY_CONTEXT_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put SANITY_CONTEXT_TOKEN --env="" | |
| fi | |
| if [ -n "$OPENROUTER_API_KEY" ]; then | |
| echo "$OPENROUTER_API_KEY" | pnpm --filter @codingcatdev/site exec wrangler secret put OPENROUTER_API_KEY --env="" | |
| fi | |
| if [ -n "$SANITY_API_WRITE_TOKEN" ]; then | |
| echo "$SANITY_API_WRITE_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put SANITY_API_WRITE_TOKEN --env="" | |
| fi | |
| if [ -n "$GUEST_PORTAL_SECRET" ]; then | |
| echo "$GUEST_PORTAL_SECRET" | pnpm --filter @codingcatdev/site exec wrangler secret put GUEST_PORTAL_SECRET --env="" | |
| fi | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| SANITY_API_READ_TOKEN: ${{ secrets.SANITY_API_READ_TOKEN }} | |
| SANITY_API_WRITE_TOKEN: ${{ secrets.SANITY_API_WRITE_TOKEN }} | |
| SANITY_AUTH_TOKEN: ${{ secrets.SANITY_AUTH_TOKEN }} | |
| SANITY_CONTEXT_TOKEN: ${{ secrets.SANITY_CONTEXT_TOKEN }} | |
| OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} | |
| GUEST_PORTAL_SECRET: ${{ secrets.GUEST_PORTAL_SECRET }} | |
| deploy-production: | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: ".nvmrc" | |
| cache: "pnpm" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Generate Sanity Types | |
| run: pnpm typegen | |
| env: | |
| SANITY_STUDIO_PROJECT_ID: hfh83o0w | |
| SANITY_STUDIO_DATASET: production | |
| - name: Generate Cloudflare Types | |
| run: pnpm --filter @codingcatdev/site cf-typegen | |
| - name: Build site (production) | |
| run: pnpm --filter @codingcatdev/site build:production | |
| - name: Deploy to Cloudflare Workers (codingcat.dev) | |
| run: pnpm --filter @codingcatdev/site exec wrangler deploy --env production | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| - name: Configure Cloudflare Worker Secrets (production) | |
| run: | | |
| echo "$SANITY_API_READ_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put SANITY_API_READ_TOKEN --env production | |
| if [ -n "$SANITY_AUTH_TOKEN" ]; then | |
| echo "$SANITY_AUTH_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put SANITY_AUTH_TOKEN --env production | |
| fi | |
| if [ -n "$SANITY_CONTEXT_TOKEN" ]; then | |
| echo "$SANITY_CONTEXT_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put SANITY_CONTEXT_TOKEN --env production | |
| fi | |
| if [ -n "$OPENROUTER_API_KEY" ]; then | |
| echo "$OPENROUTER_API_KEY" | pnpm --filter @codingcatdev/site exec wrangler secret put OPENROUTER_API_KEY --env production | |
| fi | |
| if [ -n "$SANITY_API_WRITE_TOKEN" ]; then | |
| echo "$SANITY_API_WRITE_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put SANITY_API_WRITE_TOKEN --env production | |
| fi | |
| if [ -n "$GUEST_PORTAL_SECRET" ]; then | |
| echo "$GUEST_PORTAL_SECRET" | pnpm --filter @codingcatdev/site exec wrangler secret put GUEST_PORTAL_SECRET --env production | |
| fi | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| SANITY_API_READ_TOKEN: ${{ secrets.SANITY_API_READ_TOKEN }} | |
| SANITY_API_WRITE_TOKEN: ${{ secrets.SANITY_API_WRITE_TOKEN }} | |
| SANITY_AUTH_TOKEN: ${{ secrets.SANITY_AUTH_TOKEN }} | |
| SANITY_CONTEXT_TOKEN: ${{ secrets.SANITY_CONTEXT_TOKEN }} | |
| OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} | |
| GUEST_PORTAL_SECRET: ${{ secrets.GUEST_PORTAL_SECRET }} |