opencode/.github/workflows/deploy.yml at dev · praxstack/opencode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
name: deploy

on:
  push:
    branches:
      - dev
      - production
      - beta
  workflow_dispatch:

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: read

jobs:
  deploy:
    if: github.repository == 'anomalyco/opencode' && (github.ref_name == 'dev' || github.ref_name == 'production' || github.ref_name == 'beta')
    runs-on: blacksmith-4vcpu-ubuntu-2404
    environment: ${{ github.ref_name }}
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - uses: ./.github/actions/setup-bun

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "24"

      # beta has no branch, environment or AWS role. Running it again needs a role trusting environment `beta` and
      # opencode/beta/CLOUDFLARE_API_TOKEN and opencode/beta/PLANETSCALE_SERVICE_TOKEN.
      - name: Configure AWS credentials
        if: github.ref_name != 'beta'
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: arn:aws:iam::604439173067:role/github/opencode-${{ github.ref_name }}
          role-session-name: opencode-${{ github.run_id }}
          aws-region: us-east-1

      - name: Read deploy secrets
        if: github.ref_name != 'beta'
        uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2
        with:
          secret-ids: |
            CLOUDFLARE_API_TOKEN,opencode/${{ github.ref_name }}/CLOUDFLARE_API_TOKEN
            PLANETSCALE_SERVICE_TOKEN,opencode/${{ github.ref_name }}/PLANETSCALE_SERVICE_TOKEN
          parse-json-secrets: false

      - run: bun sst deploy --stage=${{ github.ref_name }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
          PLANETSCALE_SERVICE_TOKEN_NAME: ${{ vars.PLANETSCALE_SERVICE_TOKEN_NAME }}
          # Only the beta stage's web app uploads sourcemaps; packages/app skips the upload without a token.
          SENTRY_AUTH_TOKEN: ${{ github.ref_name == 'beta' && secrets.SENTRY_AUTH_TOKEN || '' }}
          SENTRY_ORG: ${{ vars.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ vars.WEB_SENTRY_PROJECT }}
          SENTRY_RELEASE: web@${{ github.sha }}
          VITE_SENTRY_DSN: ${{ vars.WEB_SENTRY_DSN }}
          VITE_SENTRY_RELEASE: web@${{ github.sha }}

  # The SST stack owns opncd.ai until this push removes its Share Worker, so this job runs after the
  # SST deploy to take the hostname without a custom-domain conflict.
  share:
    needs: deploy
    if: github.repository == 'anomalyco/opencode' && github.ref_name != 'beta'
    runs-on: blacksmith-4vcpu-ubuntu-2404
    environment: ${{ github.ref_name }}
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - uses: ./.github/actions/setup-bun

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: arn:aws:iam::604439173067:role/github/opencode-${{ github.ref_name }}
          role-session-name: opencode-${{ github.run_id }}
          aws-region: us-east-1

      - name: Read deploy secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2
        with:
          secret-ids: CLOUDFLARE_API_TOKEN,opencode/${{ github.ref_name }}/CLOUDFLARE_API_TOKEN
          parse-json-secrets: false

      - run: bun run deploy:${{ github.ref_name }}
        working-directory: services/share