deploy-github-pages.yml

name: "Deploy ePlus OnAir to GitHub Pages"

# Deploy only merged, trusted source. Never give publishing credentials to PRs.
on:
  push:
    branches: [develop, main]
    # Only changes to the delivered website justify regenerating thousands of
    # station pages. Workflows, docs, tests and one-off crawlers do not.
    paths:
      - "app.vue"
      # Workflow-only release fixes must be able to trigger deployment.
      - ".github/workflows/deploy-github-pages.yml"
      - "app.config.ts"
      - "error.vue"
      - "nuxt.config.ts"
      - "package.json"
      - "package-lock.json"
      - "tsconfig.json"
      - "assets/**"
      - "build/**"
      - "components/**"
      - "composables/**"
      - "config/**"
      - "data/**"
      - "lang/**"
      - "layouts/**"
      - "middleware/**"
      - "pages/**"
      - "plugins/**"
      - "public/**"
      - "server/**"
      - "stores/**"
      - "types/**"
      - "utils/**"
      - "scripts/build-station-search-index.mjs"
      - "scripts/generate-social-preview.mjs"
      - "scripts/generate-station-og-images.mjs"
  # Manual deploy remains possible even without site changes.
  workflow_dispatch:

permissions:
  contents: read

# All repository work shares one queue, including different PRs/branches.
# Preserve distinct queued work; never interrupt an active deploy/image upload.
concurrency:
  group: onair-repository-work
  queue: max
  cancel-in-progress: false

jobs:
  publish:
    name: "Publish ${{ github.ref_name }} to Pages"
    # Production is released from trusted main pushes; the first step verifies
    # the exact public repository, credentials, domain and write permission.
    # Staging remains explicitly opt-in via PAGES_DEV_READY.
    if: >-
      (github.ref_name == 'develop' && vars.PAGES_DEV_READY == 'true') ||
      (github.ref_name == 'main')
    runs-on: ubuntu-latest
    timeout-minutes: 90
    # Same variable name is scoped independently in the two GitHub Environments.
    environment:
      name: ${{ github.ref_name == 'main' && 'production' || 'development' }}
    env:
      NUXT_PUBLIC_SITE_URL: ${{ vars.NUXT_PUBLIC_SITE_URL }}
      NUXT_APP_BASE_URL: /
      # Indexing is branch-specific: development never indexed, main indexed.
      # Never force noindex globally; that breaks production SEO and GA4.
      NUXT_PUBLIC_NO_INDEX: ${{ github.ref_name == 'develop' && 'true' || 'false' }}
      TARGET_REPOSITORY: ${{ github.ref_name == 'main' && 'ePlus-DEV/onair-production-pages' || 'ePlus-DEV/onair-staging-pages' }}
      TARGET_DOMAIN: ${{ github.ref_name == 'main' && 'radio.eplus.dev' || 'new-radio.eplus.dev' }}
      ONAIR_SKIP_STATION_OG: 'true'
      NUXT_PUBLIC_STATION_OG_BASE_URL: ${{ vars.STATION_OG_BASE_URL }}
      TARGET_KIND: ${{ github.ref_name == 'main' && 'production' || 'staging' }}
      SEO_EXPECTED_SITE_URL: ${{ vars.NUXT_PUBLIC_SITE_URL }}
    steps:
      - name: Skip an obsolete queued website release
        id: current
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          live_sha="$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_REF_NAME" --jq '.sha')"
          if [ "$live_sha" != "$GITHUB_SHA" ]; then
            echo "::notice::Skip obsolete deployment: a newer commit exists on $GITHUB_REF_NAME."
            echo "run=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "run=true" >> "$GITHUB_OUTPUT"

      # Cheap preflight BEFORE npm ci and 4,000+ page prerender. This catches
      # missing target repositories, expired PATs and wrong credentials fast.
      - name: Verify exact Pages repository and PAT before building
        if: steps.current.outputs.run == 'true'
        shell: bash
        env:
          PAGES_DEPLOY_TOKEN: ${{ secrets.PAGES_DEPLOY_TOKEN }}
        run: |
          set -euo pipefail
          case "$TARGET_REPOSITORY:$TARGET_DOMAIN" in
            ePlus-DEV/onair-staging-pages:new-radio.eplus.dev|ePlus-DEV/onair-production-pages:radio.eplus.dev) ;;
            *) echo "::error::Unexpected Pages target repository or domain"; exit 1 ;;
          esac
          if [ "$NUXT_PUBLIC_SITE_URL" != "https://$TARGET_DOMAIN" ] || [ "$NUXT_APP_BASE_URL" != "/" ]; then
            echo "::error::Check Environment variable NUXT_PUBLIC_SITE_URL: expected https://$TARGET_DOMAIN and Nuxt base /."
            exit 1
          fi
          if [ -z "$PAGES_DEPLOY_TOKEN" ]; then
            echo "::error::Missing PAGES_DEPLOY_TOKEN in the source repository's environment secrets."
            exit 1
          fi
          auth="$(printf 'x-access-token:%s' "$PAGES_DEPLOY_TOKEN" | base64 -w0)"
          if ! GIT_TERMINAL_PROMPT=0 git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $auth" \
            ls-remote --exit-code "https://github.com/$TARGET_REPOSITORY.git" refs/heads/main >/dev/null; then
            echo "::error::Pages target $TARGET_REPOSITORY is missing or this token cannot read it."
            exit 1
          fi
          # Read access alone is insufficient: check that the PAT can push
          # before spending minutes on Nuxt generation.
          if ! curl --fail --silent --show-error \
            -H "Authorization: Bearer $PAGES_DEPLOY_TOKEN" \
            -H "Accept: application/vnd.github+json" \
            "https://api.github.com/repos/$TARGET_REPOSITORY" | node -e '
              let data = "";
              process.stdin.on("data", chunk => { data += chunk; });
              process.stdin.on("end", () => {
                try {
                  const repo = JSON.parse(data);
                  if (repo.permissions?.push !== true) {
                    console.error("::error::The Pages PAT does not have write access to the selected repository.");
                    process.exitCode = 1;
                  }
                } catch {
                  console.error("::error::Could not validate Pages token permissions.");
                  process.exitCode = 1;
                }
              });
            '; then
            echo "::error::Fix Pages token Contents permissions before rebuilding."
            exit 1
          fi
          echo "Validated target $TARGET_REPOSITORY and read/write PAT permissions."

      - name: Check out trusted source
        if: steps.current.outputs.run == 'true'
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set up Node.js
        if: steps.current.outputs.run == 'true'
        uses: actions/setup-node@v7
        with:
          node-version: "24.15.0"
          cache: npm

      - name: Install dependencies
        if: steps.current.outputs.run == 'true'
        run: npm ci

      - name: Run unit tests
        if: steps.current.outputs.run == 'true'
        run: npm test

      - name: Generate static website
        if: steps.current.outputs.run == 'true'
        run: npm run generate:site

      - name: Check SEO for chosen environment
        if: steps.current.outputs.run == 'true'
        run: |
          node scripts/assert-sitemap-xml.mjs
          node scripts/assert-route-social-meta.mjs
          node scripts/assert-all-station-social-meta.mjs
          node scripts/assert-brand-assets.mjs
          if [ "$TARGET_KIND" = staging ]; then
            node scripts/assert-staging-noindex.mjs
          fi

      - name: Check project Pages links and artwork before publishing
        if: steps.current.outputs.run == 'true'
        run: node scripts/assert-project-pages-output.mjs .output/public custom-domain

      - name: Check Pages output and GitHub hosting size limit
        if: steps.current.outputs.run == 'true'
        run: node scripts/check-pages-build.mjs .output/public "$TARGET_KIND"

      - name: Publish generated output to public repository
        if: steps.current.outputs.run == 'true'
        shell: bash
        env:
          PAGES_DEPLOY_TOKEN: ${{ secrets.PAGES_DEPLOY_TOKEN }}
        run: |
          set -euo pipefail

          if [ -z "$PAGES_DEPLOY_TOKEN" ]; then
            echo "::error::Missing PAGES_DEPLOY_TOKEN secret with Contents: Read and write access to both public Pages repositories."
            exit 1
          fi

          target="$RUNNER_TEMP/onair-pages"
          auth="$(printf 'x-access-token:%s' "$PAGES_DEPLOY_TOKEN" | base64 -w0)"
          GIT_TERMINAL_PROMPT=0 git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $auth" clone --depth 1 --branch main "https://github.com/$TARGET_REPOSITORY.git" "$target"
          # Keep the destination repository README across generated-site releases.
          rsync -a --delete --exclude='.git/' --exclude='/README.md' "$GITHUB_WORKSPACE/.output/public/" "$target/"
          touch "$target/.nojekyll"

          # rsync --delete replaces the output tree; restore the custom domain
          # before committing so a redeploy never removes GitHub Pages CNAME.
          printf '%s\n' "$TARGET_DOMAIN" > "$target/CNAME"

          git -C "$target" config user.name "github-actions[bot]"
          git -C "$target" config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git -C "$target" add --all

          if git -C "$target" diff --cached --quiet; then
            echo "No changes to publish to $TARGET_REPOSITORY."
            exit 0
          fi

          git -C "$target" commit -m "deploy: $TARGET_KIND from $GITHUB_REPOSITORY@$GITHUB_SHA"
          # GITHUB_TOKEN cannot write to a different repository. Keep the
          # repository-scoped PAT out of the remote URL and git configuration.
          auth="$(printf 'x-access-token:%s' "$PAGES_DEPLOY_TOKEN" | base64 -w0)"
          git -C "$target" -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $auth" push origin HEAD:main
          echo "Published $TARGET_KIND to $TARGET_REPOSITORY"