ci: deploy workflow and deploy after recording results

Author: rigor789

.github/workflows/compat-check.yml

@@ -212,3 +212,20 @@ jobs:
             git pull --rebase
           done
           exit 1
+      # Commits made with the Actions token do not trigger the deploy
+      # workflow, so the results are deployed from here.
+      - name: Deploy
+        if: env.CLOUDFLARE_API_TOKEN != ''
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+        run: |
+          npm ci
+          npx vite build
+      - uses: cloudflare/wrangler-action@v3
+        if: env.CLOUDFLARE_API_TOKEN != ''
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: deploy

.github/workflows/deploy.yml

@@ -0,0 +1,48 @@
+# Deploys the Worker and the app to Cloudflare on every push to the default
+# branch that touches something deployable. Needs two repository secrets:
+#   CLOUDFLARE_API_TOKEN   an API token with the "Edit Cloudflare Workers" template
+#   CLOUDFLARE_ACCOUNT_ID  the account that owns the Worker
+name: deploy
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "worker/**"
+      - "shared/**"
+      - "web/**"
+      - "data/**"
+      - "schemas/**"
+      - "index.html"
+      - "vite.config.ts"
+      - "wrangler.jsonc"
+      - "package.json"
+      - "package-lock.json"
+      - ".github/workflows/deploy.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: deploy
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm test
+      - run: npm run check
+      - run: npx vite build
+      - uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: deploy

README.md

@@ -104,3 +104,19 @@ npm run build       # client and Worker into dist/, with a generated wrangler.js
 npm run deploy      # build, then wrangler deploy
 npm test && npm run check
 ```
+
+## Deploying
+
+One-time setup:
+
+1. `npx wrangler login`, then `npx wrangler kv namespace create COMPAT_KV` and
+   paste the printed id into `wrangler.jsonc`.
+2. Add two repository secrets: `CLOUDFLARE_API_TOKEN` (an API token created
+   from the "Edit Cloudflare Workers" template) and `CLOUDFLARE_ACCOUNT_ID`.
+3. For the custom domain, uncomment the `routes` entry in `wrangler.jsonc`
+   once the `nativescript.org` zone lives on that account.
+
+After that, the `deploy` workflow deploys every push to `main` that touches
+deployable files, and `compat-check` deploys the results it records. From a
+machine that is logged in, `npm run deploy` does the same by hand. The hourly
+cron trigger is part of the deployment.

wrangler.jsonc

@@ -10,9 +10,12 @@
 		"not_found_handling": "none"
 	},
 	"kv_namespaces": [
-		// `id` is a placeholder until the namespace exists; `wrangler dev` uses local storage.
+		// Create once with `npx wrangler kv namespace create COMPAT_KV` and paste the id
+		// it prints; `wrangler dev` ignores it and uses local storage.
 		{ "binding": "COMPAT_KV", "id": "00000000000000000000000000000000" }
 	],
+	// Once the nativescript.org zone is on the deploying account:
+	// "routes": [{ "pattern": "compatibility.nativescript.org", "custom_domain": true }],
 	"triggers": { "crons": ["0 * * * *"] },
 	"vars": {
 		"NPM_REGISTRY": "https://registry.npmjs.org/"