name: Publish server key release
on:
  push:
    branches: [main]
  workflow_dispatch:
permissions:
  contents: read
concurrency:
  group: production-key-release
  cancel-in-progress: false
jobs:
  deploy:
    # Deliberate opt-in prevents accidental deployment when this PR is merged.
    # Configure production credentials and real server keys before enabling.
    if: github.ref == 'refs/heads/main' && vars.ENABLE_WORKER_DEPLOY == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment: production
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: '22'
          cache: npm
      - run: npm ci
      - name: Install shell test interpreters
        run: |
          if ! command -v busybox >/dev/null || ! command -v shellcheck >/dev/null; then
            sudo apt-get update
            sudo apt-get install -y busybox-static shellcheck
          fi
          busybox sh -c 'echo "BusyBox shell ready"'
          shellcheck --version
      - run: npm test
        env:
          BROWSER_TESTS: '1'
      - name: Build production release (empty keys fail unless explicitly allowed)
        run: npm run build
      - run: node scripts/verify-release.mjs
      - name: Deploy the validated production bundle
        run: npx wrangler deploy --config cf-worker/wrangler.toml
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
      - name: Verify published revision and public key payload
        run: node scripts/verify-release.mjs --remote