gitbook/.github/composite/deploy-cloudflare/action.yaml

name: 'Deploy cloudflare'
description: 'Deploy GitBook to Cloudflare'
inputs:
    opItem:
        description: '1Password item to load secrets from'
        required: true
    opServiceAccount:
        description: '1Password service account token'
        required: true
    apiToken:
        description: 'Cloudflare API token'
        required: true
    accountId:
        description: 'Cloudflare account ID'
        required: true
    environment:
        description: 'Cloudflare environment to deploy to (staging, production, preview)'
        required: true
    deploy:
        description: 'Deploy as main version for all traffic instead of uploading versions'
        required: true
    commitTag:
        description: 'Commit branch to associate with the deployment'
        required: true
    commitMessage:
        description: 'Commit message to associate with the deployment'
        required: true
    headSha:
        description: 'Git ref being deployed, used for the deploymentId. Falls back to GITHUB_SHA'
        required: false
outputs:
    deployment-url:
        description: 'Deployment URL'
        value: ${{ steps.upload_middleware.outputs.deployment-url }}
runs:
    using: 'composite'
    steps:
        - name: Setup Bun
          uses: ./.github/composite/setup-bun
        - name: Install dependencies
          run: bun install --frozen-lockfile
          shell: bash
          env:
              PUPPETEER_SKIP_DOWNLOAD: 1
        - name: Load secret
          uses: 1password/load-secrets-action@v2
          env:
              OP_SERVICE_ACCOUNT_TOKEN: ${{ inputs.opServiceAccount }}
              GITBOOK_URL: ${{ inputs.opItem }}/GITBOOK_URL
              GITBOOK_ICONS_URL: ${{ inputs.opItem }}/GITBOOK_ICONS_URL
              GITBOOK_ICONS_TOKEN: ${{ inputs.opItem }}/GITBOOK_ICONS_TOKEN
              NEXT_SERVER_ACTIONS_ENCRYPTION_KEY: ${{ inputs.opItem }}/NEXT_SERVER_ACTIONS_ENCRYPTION_KEY
              GITBOOK_SECRET: ${{ inputs.opItem }}/GITBOOK_SECRET
              GITBOOK_APP_URL: ${{ inputs.opItem }}/GITBOOK_APP_URL
              GITBOOK_API_URL: ${{ inputs.opItem }}/GITBOOK_API_URL
              GITBOOK_API_PUBLIC_URL: ${{ inputs.opItem }}/GITBOOK_API_PUBLIC_URL
              GITBOOK_API_TOKEN: ${{ inputs.opItem }}/GITBOOK_API_TOKEN
              GITBOOK_OAUTH_SERVER_URL: ${{ inputs.opItem }}/GITBOOK_OAUTH_SERVER_URL
              GITBOOK_SITE_OAUTH_SIGNING_SECRET: ${{ inputs.opItem }}/GITBOOK_SITE_OAUTH_SIGNING_SECRET
              GITBOOK_PREVIEW_BASE_URL: ${{ inputs.opItem }}/GITBOOK_PREVIEW_BASE_URL
              GITBOOK_INTEGRATIONS_HOST: ${{ inputs.opItem }}/GITBOOK_INTEGRATIONS_HOST
              GITBOOK_INTEGRATIONS_CONTENT_HOST: ${{ inputs.opItem }}/GITBOOK_INTEGRATIONS_CONTENT_HOST
              GITBOOK_IMAGE_RESIZE_SIGNING_KEY: ${{ inputs.opItem }}/GITBOOK_IMAGE_RESIZE_SIGNING_KEY
              GITBOOK_IMAGE_RESIZE_URL: ${{ inputs.opItem }}/GITBOOK_IMAGE_RESIZE_URL_2
              GITBOOK_IMAGE_RESIZE_SALT: ${{ inputs.opItem }}/GITBOOK_IMAGE_RESIZE_SALT
              GITBOOK_IMAGE_RESIZE_MODE: ${{ inputs.opItem }}/GITBOOK_IMAGE_RESIZE_MODE
              GITBOOK_ASSETS_PREFIX: ${{ inputs.opItem }}/GITBOOK_ASSETS_PREFIX
              GITBOOK_FONTS_URL: ${{ inputs.opItem }}/GITBOOK_FONTS_URL
        # `build:all` shares a single `next build` between the workerd tier (.open-next) and the
        # container tier (.open-next-container), so both are built from the same bundle.
        - name: Build worker
          run: bun run turbo build:all
          env:
              GITBOOK_RUNTIME: cloudflare
              # `pull_request_target` sets GITHUB_SHA to the base branch tip, identical for every
              # commit of a PR, which would keep the deployment ID (and its cache) unchanged.
              GITBOOK_HEAD_SHA: ${{ inputs.headSha }}
              VERCEL_TARGET_ENV: ${{ inputs.environment }}
              GITBOOK_BLOCK_SEARCH_INDEXATION: ${{ inputs.environment == 'preview' && 'true' || '' }}
              GITBOOK_ALLOW_CUSTOMIZATION_OVERRIDE: ${{ inputs.environment == 'preview' && 'true' || '' }}
          shell: bash

        - id: extract_deployment_id
          name: Extract Next deployment ID
          shell: bash
          run: |
              deployment_id=$(bun -e '
                  const buildOutput = await Bun.file("packages/gitbook/.open-next/server-functions/default/packages/gitbook/.next/required-server-files.json").json();
                  const deploymentId = buildOutput.config?.deploymentId;
                  if (!deploymentId) throw new Error("Next build did not emit a deployment ID");
                  console.log(deploymentId);
              ')
              echo "deployment_id=$deployment_id" >> $GITHUB_OUTPUT

        - name: Upload the DO worker
          uses: cloudflare/wrangler-action@v3.14.0
          with:
              apiToken: ${{ inputs.apiToken }}
              accountId: ${{ inputs.accountId }}
              workingDirectory: ./
              wranglerVersion: '4.122.0'
              environment: ${{ inputs.environment }}
              command: ${{ format('deploy --var OPEN_NEXT_BUILD_ID:{0} --config ./packages/gitbook/openNext/customWorkers/doWrangler.jsonc', steps.extract_deployment_id.outputs.deployment_id) }}

        # `versions upload` never builds or pushes the container image, so the container tier uses
        # `deploy` like the DO worker. It runs after the DO worker (whose Durable Objects it binds)
        # and before the server and middleware (which read the cache tier it now hosts).
        #
        # `--x-provision=false` disables Wrangler's resource provisioning. It is on by default and
        # probes the R2 API for any binding the deployed Worker does not already have, which our
        # API token has no permission for. Every bucket here already exists, so there is nothing to
        # provision.
        - name: Deploy the container worker
          uses: cloudflare/wrangler-action@v3.14.0
          with:
              apiToken: ${{ inputs.apiToken }}
              accountId: ${{ inputs.accountId }}
              workingDirectory: ./
              wranglerVersion: '4.122.0'
              environment: ${{ inputs.environment }}
              command: ${{ format('deploy --x-provision=false --var OPEN_NEXT_BUILD_ID:{0} --config ./packages/gitbook/openNext/customWorkers/containerWrangler.jsonc', steps.extract_deployment_id.outputs.deployment_id) }}

        - id: upload_server
          name: Upload server to Cloudflare
          uses: cloudflare/wrangler-action@v3.14.0
          with:
              apiToken: ${{ inputs.apiToken }}
              accountId: ${{ inputs.accountId }}
              workingDirectory: ./
              wranglerVersion: '4.122.0'
              environment: ${{ inputs.environment }}
              command: ${{ format('versions upload --tag {0} --message "{1}"', inputs.commitTag, inputs.commitMessage) }} --config ./packages/gitbook/openNext/customWorkers/defaultWrangler.jsonc

        - name: Extract server version worker ID
          shell: bash
          id: extract_server_version_id
          run: |
              version_id=$(echo '${{ steps.upload_server.outputs.command-output }}' | grep "Worker Version ID" | awk '{print $4}')
              echo "version_id=$version_id" >> $GITHUB_OUTPUT

        - name: Run updateWrangler scripts
          shell: bash
          run: |
              bun run ./packages/gitbook/openNext/customWorkers/script/updateWrangler.ts ${{ steps.extract_server_version_id.outputs.version_id }}

        - id: upload_middleware
          name: Upload middleware to Cloudflare
          uses: cloudflare/wrangler-action@v3.14.0
          with:
              apiToken: ${{ inputs.apiToken }}
              accountId: ${{ inputs.accountId }}
              workingDirectory: ./
              wranglerVersion: '4.122.0'
              environment: ${{ inputs.environment }}
              command: ${{ format('versions upload --tag {0} --message "{1}"', inputs.commitTag, inputs.commitMessage) }} --config ./packages/gitbook/openNext/customWorkers/middlewareWrangler.jsonc

        - name: Extract middleware version worker ID
          shell: bash
          id: extract_middleware_version_id
          run: |
              version_id=$(echo '${{ steps.upload_middleware.outputs.command-output }}' | grep "Worker Version ID" | awk '{print $4}')
              echo "version_id=$version_id" >> $GITHUB_OUTPUT

        - name: Deploy server and middleware to Cloudflare
          if: ${{ inputs.deploy == 'true' }}
          uses: ./.github/actions/gradual-deploy-cloudflare
          with:
              apiToken: ${{ inputs.apiToken }}
              accountId: ${{ inputs.accountId }}
              opServiceAccount: ${{ inputs.opServiceAccount }}
              opItem: ${{ inputs.opItem }}
              environment: ${{ inputs.environment }}
              serverVersionId: ${{ steps.extract_server_version_id.outputs.version_id }}
              middlewareVersionId: ${{ steps.extract_middleware_version_id.outputs.version_id }}
              deploy: ${{ inputs.deploy }}

        - name: Outputs
          shell: bash
          env:
              DEPLOYMENT_URL: ${{ steps.upload_middleware.outputs.deployment-url }}
          run: |
              echo "URL: ${{ steps.upload_middleware.outputs.deployment-url }}"
              echo "Output server: ${{ steps.upload_server.outputs.command-output }}"