deploy.yml

name: Deploy

on:
  push:

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-24.04
    if: github.repository_owner == 'harryzcy'
    permissions:
      contents: read
      deployments: write
    name: Publish to Cloudflare Pages
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          disable-sudo: true
          disable-telemetry: true
          egress-policy: block
          allowed-endpoints: >
            api.cloudflare.com:443
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
            sparrow.cloudflare.com:443

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
        with:
          node-version: 20
          check-latest: true

      - name: Extract branch name
        shell: bash
        run: |
          if [[ "${GITHUB_REF}" =~ ^refs/tags/ ]]; then
            echo "branch=main" >> "$GITHUB_OUTPUT"
          else
            echo "branch=${GITHUB_REF#refs/heads/}" >> "$GITHUB_OUTPUT"
          fi
        id: extract_branch

      - name: Build
        run: |
          make build-cloudflare

      - name: Publish to Cloudflare Pages
        uses: cloudflare/wrangler-action@7a5f8bbdfeedcde38e6777a50fe685f89259d4ca # v3.13.1
        if: ${{ github.actor != 'dependabot[bot]' }}
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: pages deploy --project-name mailbox-browser --branch ${{ steps.extract_branch.outputs.branch }} dist
          workingDirectory: cloudflare
          wranglerVersion: "3"