open-design/.github/workflows/landing-page-deploy.yml

name: landing-page-deploy

on:
  push:
    branches:
      - main
    paths:
      # Workflow files
      - .github/workflows/landing-page-deploy.yml
      - .github/workflows/landing-page-ci.yml
      # Landing page sources
      - apps/landing-page/**
      # Content sources — Astro content collections glob these at build
      # time. Adding/removing a SKILL.md, DESIGN.md, craft principle, or
      # live-artifact template MUST trigger a redeploy or the published
      # site falls behind silently.
      - skills/**
      - design-systems/**
      - craft/**
      - templates/**
      # Workspace plumbing
      - package.json
      - pnpm-lock.yaml
      - pnpm-workspace.yaml
  workflow_dispatch:

permissions:
  contents: read
  deployments: write

concurrency:
  group: landing-page-deploy-${{ github.ref }}
  cancel-in-progress: true

jobs:
  deploy:
    name: Deploy landing page
    if: github.repository == 'nexu-io/open-design'
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: 10.33.2

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Resolve Playwright version
        id: playwright-version
        run: |
          version=$(node -p "require('./apps/landing-page/package.json').devDependencies.playwright.replace(/[^0-9.]/g,'')")
          echo "version=$version" >> "$GITHUB_OUTPUT"          

      - name: Cache Playwright browsers
        uses: actions/cache@v4
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}

      - name: Install Playwright Chromium
        run: pnpm --filter @open-design/landing-page exec playwright install --with-deps chromium

      - name: Typecheck landing page
        run: pnpm --filter @open-design/landing-page typecheck

      # Generate previews before build so they end up in `out/previews/`.
      # Soft vs. hard failure is enforced inside the script itself:
      # individual broken `example.html` entries are logged and skipped,
      # but a systemic failure (chromium launch error, every job failing)
      # exits non-zero so we don't silently ship a deploy with zero
      # thumbnails to production.
      - name: Generate skill + template previews
        run: pnpm --filter @open-design/landing-page previews

      - name: Build landing page
        run: pnpm --filter @open-design/landing-page build

      - name: Verify zero external JavaScript
        run: |
          node <<'NODE'
          const { readFileSync } = require('node:fs');
          const html = readFileSync('apps/landing-page/out/index.html', 'utf8');
          const forbidden = [
            /<script\b[^>]*\bsrc=/i,
            /type=["']module["']/i,
            /\/_astro\/[^"'<>\s]+\.js/i,
          ];
          for (const pattern of forbidden) {
            if (pattern.test(html)) {
              console.error(`Unexpected client JavaScript matched ${pattern}`);
              process.exit(1);
            }
          }
          NODE          

      - name: Verify Cloudflare image resizing URLs
        run: |
          node <<'NODE'
          const { readFileSync } = require('node:fs');
          const html = readFileSync('apps/landing-page/out/index.html', 'utf8');
          const resizedUrls = html.match(/https:\/\/static\.open-design\.ai\/cdn-cgi\/image\//g) ?? [];
          if (resizedUrls.length < 16) {
            console.error(`Expected at least 16 Cloudflare resized image URLs, found ${resizedUrls.length}`);
            process.exit(1);
          }
          if (/(?:src|content)=["']\/assets\/[A-Za-z0-9_.-]+\.png/.test(html)) {
            console.error('Found local /assets/*.png image reference in generated landing HTML.');
            process.exit(1);
          }
          NODE          

      - name: Deploy to Cloudflare Pages
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          workingDirectory: apps/landing-page
          packageManager: npm
          command: >
            pages deploy out
            --project-name=open-design-landing
            --branch=${{ github.ref_name }}