| 1 | name: Deploy crash worker |
| 2 | |
| 3 | on: |
| 4 | push: |
| 5 | branches: [main-v2] |
| 6 | paths: |
| 7 | - 'workers/crash-report/**' |
| 8 | - '.github/workflows/deploy-crash-worker.yml' |
| 9 | workflow_dispatch: |
| 10 | |
| 11 | permissions: |
| 12 | contents: read |
| 13 | |
| 14 | concurrency: |
| 15 | group: deploy-crash-worker |
| 16 | cancel-in-progress: false |
| 17 | |
| 18 | jobs: |
| 19 | deploy: |
| 20 | runs-on: ubuntu-latest |
| 21 | steps: |
| 22 | - uses: actions/checkout@v7 |
| 23 | - uses: actions/setup-node@v7 |
| 24 | with: |
| 25 | node-version: '22' |
| 26 | cache: npm |
| 27 | cache-dependency-path: workers/crash-report/package-lock.json |
| 28 | - name: Deploy |
| 29 | working-directory: workers/crash-report |
| 30 | env: |
| 31 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 32 | run: | |
| 33 | npm ci |
| 34 | npm run typecheck |
| 35 | npm test |
| 36 | npx wrangler deploy |
| 37 | # Mirrors the ALERT_WEBHOOK repo secret into the worker so the ingest |
| 38 | # sentinel can push alerts (see runIngestSentinel). Managed here so |
| 39 | # nobody needs local Cloudflare credentials; when the repo secret is |
| 40 | # unset the sentinel stays log-only. |
| 41 | - name: Sync alert webhook secret |
| 42 | working-directory: workers/crash-report |
| 43 | env: |
| 44 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 45 | ALERT_WEBHOOK: ${{ secrets.ALERT_WEBHOOK }} |
| 46 | run: | |
| 47 | if [ -z "$ALERT_WEBHOOK" ]; then |
| 48 | echo "ALERT_WEBHOOK repo secret not set; removing any existing worker secret." |
| 49 | printf '{"ALERT_WEBHOOK":null}' | npx wrangler secret bulk |
| 50 | exit 0 |
| 51 | fi |
| 52 | printf '%s' "$ALERT_WEBHOOK" | npx wrangler secret put ALERT_WEBHOOK |
| 53 |