| 1 | name: Deploy crash worker |
| 2 | |
| 3 | on: |
| 4 | push: |
| 5 | branches: [main-v2] |
| 6 | paths: |
| 7 | - 'workers/crash-report/**' |
| 8 | - '.github/workflows/deploy-crash-worker.yml' |
| 9 | workflow_dispatch: |
| 10 | inputs: |
| 11 | firebase_data_action: |
| 12 | description: Firebase crash history operation (migration actions do not deploy the Worker) |
| 13 | required: true |
| 14 | default: none |
| 15 | type: choice |
| 16 | options: |
| 17 | - none |
| 18 | - dry-run |
| 19 | - apply |
| 20 | - verify-only |
| 21 | confirmation: |
| 22 | description: Enter APPLY_FIREBASE_CRASH_DATA when selecting apply |
| 23 | required: false |
| 24 | default: '' |
| 25 | type: string |
| 26 | |
| 27 | permissions: |
| 28 | contents: read |
| 29 | |
| 30 | concurrency: |
| 31 | group: deploy-crash-worker |
| 32 | cancel-in-progress: false |
| 33 | |
| 34 | jobs: |
| 35 | deploy: |
| 36 | if: github.event_name == 'push' || inputs.firebase_data_action == 'none' |
| 37 | runs-on: ubuntu-latest |
| 38 | steps: |
| 39 | - uses: actions/checkout@v7 |
| 40 | - uses: actions/setup-node@v7 |
| 41 | with: |
| 42 | node-version: '22' |
| 43 | cache: npm |
| 44 | cache-dependency-path: workers/crash-report/package-lock.json |
| 45 | - name: Validate |
| 46 | working-directory: workers/crash-report |
| 47 | run: | |
| 48 | npm ci |
| 49 | npm run typecheck |
| 50 | npm test |
| 51 | - name: Apply and verify diagnostics v2 D1 migration |
| 52 | working-directory: workers/crash-report |
| 53 | env: |
| 54 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 55 | run: npm run migrate:diagnostics-v2 |
| 56 | - name: Apply and verify Firebase crash D1 migration |
| 57 | working-directory: workers/crash-report |
| 58 | env: |
| 59 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 60 | run: npm run migrate:firebase-crash |
| 61 | - name: Apply dashboard performance indexes |
| 62 | working-directory: workers/crash-report |
| 63 | env: |
| 64 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 65 | run: npm run migrate:dashboard-indexes |
| 66 | - name: Apply registry performance indexes and install rollup |
| 67 | working-directory: workers/crash-report |
| 68 | env: |
| 69 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 70 | run: npm run migrate:registry-indexes |
| 71 | - name: Sync Firebase crash secrets |
| 72 | working-directory: workers/crash-report |
| 73 | env: |
| 74 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 75 | FIREBASE_DATABASE_URL: ${{ secrets.FIREBASE_DATABASE_URL }} |
| 76 | FIREBASE_CLIENT_EMAIL: ${{ secrets.FIREBASE_CLIENT_EMAIL }} |
| 77 | FIREBASE_PRIVATE_KEY: ${{ secrets.FIREBASE_PRIVATE_KEY }} |
| 78 | run: | |
| 79 | configured=0 |
| 80 | [ -n "$FIREBASE_DATABASE_URL" ] && configured=$((configured + 1)) |
| 81 | [ -n "$FIREBASE_CLIENT_EMAIL" ] && configured=$((configured + 1)) |
| 82 | [ -n "$FIREBASE_PRIVATE_KEY" ] && configured=$((configured + 1)) |
| 83 | if [ "$configured" -ne 0 ] && [ "$configured" -ne 3 ]; then |
| 84 | echo "Firebase crash secrets must be either all configured or all absent." |
| 85 | exit 1 |
| 86 | fi |
| 87 | node -e 'process.stdout.write(JSON.stringify({FIREBASE_DATABASE_URL:process.env.FIREBASE_DATABASE_URL||null,FIREBASE_CLIENT_EMAIL:process.env.FIREBASE_CLIENT_EMAIL||null,FIREBASE_PRIVATE_KEY:process.env.FIREBASE_PRIVATE_KEY||null}))' | npx wrangler secret bulk |
| 88 | - name: Deploy |
| 89 | working-directory: workers/crash-report |
| 90 | env: |
| 91 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 92 | run: | |
| 93 | npx wrangler deploy |
| 94 | # Mirrors the ALERT_WEBHOOK repo secret into the worker so the ingest |
| 95 | # sentinel can push alerts (see runIngestSentinel). Managed here so |
| 96 | # nobody needs local Cloudflare credentials; when the repo secret is |
| 97 | # unset the sentinel stays log-only. |
| 98 | - name: Sync alert webhook secret |
| 99 | working-directory: workers/crash-report |
| 100 | env: |
| 101 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 102 | ALERT_WEBHOOK: ${{ secrets.ALERT_WEBHOOK }} |
| 103 | run: | |
| 104 | if [ -z "$ALERT_WEBHOOK" ]; then |
| 105 | echo "ALERT_WEBHOOK repo secret not set; removing any existing worker secret." |
| 106 | printf '{"ALERT_WEBHOOK":null}' | npx wrangler secret bulk |
| 107 | exit 0 |
| 108 | fi |
| 109 | printf '%s' "$ALERT_WEBHOOK" | npx wrangler secret put ALERT_WEBHOOK |
| 110 | |
| 111 | migrate-firebase-data: |
| 112 | if: github.event_name == 'workflow_dispatch' && inputs.firebase_data_action != 'none' |
| 113 | runs-on: ubuntu-latest |
| 114 | environment: canary |
| 115 | steps: |
| 116 | - uses: actions/checkout@v7 |
| 117 | - name: Require the protected production branch |
| 118 | run: | |
| 119 | if [ "$GITHUB_REF" != "refs/heads/main-v2" ]; then |
| 120 | echo "Firebase crash data migration must run from main-v2." |
| 121 | exit 1 |
| 122 | fi |
| 123 | - uses: actions/setup-node@v7 |
| 124 | with: |
| 125 | node-version: '22' |
| 126 | cache: npm |
| 127 | cache-dependency-path: workers/crash-report/package-lock.json |
| 128 | - name: Validate |
| 129 | working-directory: workers/crash-report |
| 130 | run: | |
| 131 | npm ci |
| 132 | npm run typecheck |
| 133 | npm test |
| 134 | - name: Run Firebase crash history operation |
| 135 | working-directory: workers/crash-report |
| 136 | env: |
| 137 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 138 | FIREBASE_DATABASE_URL: ${{ secrets.FIREBASE_DATABASE_URL }} |
| 139 | FIREBASE_CLIENT_EMAIL: ${{ secrets.FIREBASE_CLIENT_EMAIL }} |
| 140 | FIREBASE_PRIVATE_KEY: ${{ secrets.FIREBASE_PRIVATE_KEY }} |
| 141 | FIREBASE_DATA_ACTION: ${{ inputs.firebase_data_action }} |
| 142 | FIREBASE_DATA_CONFIRMATION: ${{ inputs.confirmation }} |
| 143 | run: | |
| 144 | configured=0 |
| 145 | [ -n "$CLOUDFLARE_API_TOKEN" ] && configured=$((configured + 1)) |
| 146 | [ -n "$FIREBASE_DATABASE_URL" ] && configured=$((configured + 1)) |
| 147 | [ -n "$FIREBASE_CLIENT_EMAIL" ] && configured=$((configured + 1)) |
| 148 | [ -n "$FIREBASE_PRIVATE_KEY" ] && configured=$((configured + 1)) |
| 149 | if [ "$configured" -ne 4 ]; then |
| 150 | echo "Cloudflare and Firebase migration secrets must all be configured." |
| 151 | exit 1 |
| 152 | fi |
| 153 | |
| 154 | case "$FIREBASE_DATA_ACTION" in |
| 155 | dry-run) |
| 156 | npm run migrate:firebase-data |
| 157 | ;; |
| 158 | apply) |
| 159 | if [ "$FIREBASE_DATA_CONFIRMATION" != "APPLY_FIREBASE_CRASH_DATA" ]; then |
| 160 | echo "Apply requires the exact confirmation APPLY_FIREBASE_CRASH_DATA." |
| 161 | exit 1 |
| 162 | fi |
| 163 | npm run migrate:firebase-data -- --apply |
| 164 | npm run migrate:firebase-data -- --verify-only |
| 165 | ;; |
| 166 | verify-only) |
| 167 | npm run migrate:firebase-data -- --verify-only |
| 168 | ;; |
| 169 | *) |
| 170 | echo "Unsupported Firebase crash data action." |
| 171 | exit 1 |
| 172 | ;; |
| 173 | esac |
| 174 |