ci: automate releases and deploy the Cloudflare demo

.github/actions/prepare-ci-image/action.yml

@@ -0,0 +1,50 @@
+name: Prepare the Cortex CI image
+description: Resolve and pull the Cortex toolchain image by its registry digest.
+
+inputs:
+  token:
+    description: GitHub token with packages read access.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Log in to GHCR
+      uses: docker/login-action@v4
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ inputs.token }}
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v4
+
+    - name: Resolve and pull the toolchain image
+      shell: bash
+      env:
+        IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/cortex-ci
+        IMAGE_HASH: ${{ hashFiles('Dockerfile') }}
+      run: |
+        set -euo pipefail
+        image_tag="${IMAGE_NAME}:toolchain-${IMAGE_HASH}"
+        digest=""
+
+        for attempt in $(seq 1 60); do
+          inspection="$(docker buildx imagetools inspect "$image_tag" 2>/dev/null || true)"
+          digest="$(awk '$1 == "Digest:" { print $2; exit }' <<< "$inspection")"
+          if [[ "$digest" == sha256:* ]]; then
+            break
+          fi
+          echo "Waiting for ${image_tag} (${attempt}/60)..."
+          sleep 10
+        done
+
+        if [[ "$digest" != sha256:* ]]; then
+          echo "The Cortex CI image is not available: ${image_tag}" >&2
+          exit 1
+        fi
+
+        image="${IMAGE_NAME}@${digest}"
+        docker pull "$image"
+        echo "CORTEX_CI_IMAGE=${image}" >> "$GITHUB_ENV"
+        echo "Using ${image}"

.github/prompts/changelog.md

@@ -0,0 +1,22 @@
+Review the commits and diff in `{{COMMIT_RANGE}}`.
+
+Write concise release notes for Cortex Docs version `{{VERSION}}` to `.release-notes.md`.
+Use only user-visible facts from the repository history.
+Do not include version changes, dependency lock changes, merge commits, or CI maintenance unless users are affected.
+
+The file must contain these three sections in this order:
+
+### New Features
+
+- One bullet for each new feature.
+
+### Bug Fixes
+
+- One bullet for each corrected fault.
+
+### Improvements
+
+- One bullet for each other user-visible improvement.
+
+Keep all three sections. Use `- None.` when a section has no entries.
+Do not add a title, version heading, date, introduction, code fence, or conclusion.

.github/workflows/ci-image.yml

@@ -0,0 +1,55 @@
+name: CI toolchain image
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [pre-release, main]
+    paths:
+      - Dockerfile
+      - .github/workflows/ci-image.yml
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: ci-toolchain-image
+  cancel-in-progress: false
+
+env:
+  IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/cortex-ci
+
+jobs:
+  publish:
+    name: publish-toolchain
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and publish the toolchain image
+        id: image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: ${{ env.IMAGE_NAME }}:toolchain-${{ hashFiles('Dockerfile') }}
+          cache-from: type=gha,scope=cortex-ci-toolchain
+          cache-to: type=gha,mode=max,scope=cortex-ci-toolchain
+
+      - name: Write the image digest
+        env:
+          IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
+        run: echo "Published ${IMAGE_NAME}@${IMAGE_DIGEST}" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/ci.yml

@@ -2,12 +2,13 @@ name: CI
 
 on:
   push:
-    branches: [pre-release, main]
+    branches: [main]
   pull_request:
     branches: [pre-release, main]
 
 permissions:
   contents: read
+  packages: read
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
@@ -60,6 +61,7 @@ jobs:
           node-version: 22
           cache: npm
       - run: npm ci
+      - run: npm run build
       - run: npx playwright install --with-deps chromium
       - run: npm run test:e2e
       - if: failure()
@@ -69,18 +71,35 @@ jobs:
           path: playwright-report/
           if-no-files-found: ignore
 
-  integration:
-    name: integration
+  sdk-integration:
+    name: sdk-integration
     if: github.event_name == 'pull_request' && github.base_ref == 'main'
     needs: [branch-flow, quality]
     runs-on: ubuntu-latest
-    timeout-minutes: 150
+    timeout-minutes: 90
     steps:
       - uses: actions/checkout@v7
+      - uses: ./.github/actions/prepare-ci-image
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/setup-node@v7
         with:
           node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run test:sdk
-      - run: npm run test:publish:e2e
+      - run: docker volume create cortex-sdk-gradle-cache
+      - run: npm run test:sdk:ci
+
+  publish-integration:
+    name: publish-integration
+    if: github.event_name == 'pull_request' && github.base_ref == 'main'
+    needs: [branch-flow, quality]
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/prepare-ci-image
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - run: npm run test:publish:e2e:ci

.github/workflows/deploy-demo.yml

@@ -0,0 +1,55 @@
+name: Deploy demo
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-demo-main
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    name: deploy demo Workers
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_branch == 'main' &&
+      !startsWith(github.event.workflow_run.head_commit.message, 'chore(release):')
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - name: Make sure that the Cloudflare zone is active
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
+        run: |
+          curl --fail --silent --show-error \
+            --header "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" \
+            "https://api.cloudflare.com/client/v4/zones/${CLOUDFLARE_ZONE_ID}" \
+            | jq --exit-status '.success == true and .result.status == "active"'
+      - name: Deploy the demo API Worker
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+        run: npm run --workspace=@cortex/demo-api deploy
+      - name: Deploy the docs UI Worker
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CORTEX_DEMO_API_URL: https://api.demo.cortexdocs.dev
+        run: npm run --workspace=@cortex/docs-ui demo:deploy

.github/workflows/integration.yml

@@ -7,17 +7,20 @@ on:
 
 permissions:
   contents: read
+  packages: read
 
 jobs:
   generated-packages:
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/prepare-ci-image
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run test:sdk
-      - run: npm run test:publish:e2e
+      - run: docker volume create cortex-sdk-gradle-cache
+      - run: npm run test:sdk:ci
+      - run: npm run test:publish:e2e:ci