name: Deploy Dev on: push: branches: [dev] workflow_dispatch: jobs: build-and-deploy: name: Deploy to Cloudflare (Dev) runs-on: ubuntu-latest env: # Pin tool versions to avoid upstream updates breaking CI WORKER_BUILD_VERSION: "0.7.1" WRANGLER_VERSION: "4.54.0" # Web Vault frontend (bw_web_builds) version tag (default pinned; override via GitHub Actions Variables) # - Set repository variable BW_WEB_VERSION_DEV (e.g. v2025.12.0) to override # - Set to "latest" to follow the latest bw_web_builds release BW_WEB_VERSION: ${{ vars.BW_WEB_VERSION_DEV || 'v2025.12.0' }} # Required for wrangler CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} steps: - uses: actions/checkout@v4 - name: Set up Node.js (for npx wrangler) uses: actions/setup-node@v4 with: node-version: "20" - name: Install Rust toolchain (from rust-toolchain.toml) run: | set -euo pipefail TOOLCHAIN="$(sed -n 's/^channel[[:space:]]*=[[:space:]]*"\([^"]*\)".*$/\1/p' rust-toolchain.toml | head -n 1)" if [ -z "$TOOLCHAIN" ]; then echo "❌ Failed to read toolchain channel from rust-toolchain.toml" >&2 exit 1 fi echo "Using Rust toolchain: $TOOLCHAIN" echo "RUSTUP_TOOLCHAIN=$TOOLCHAIN" >> "$GITHUB_ENV" rustup toolchain install "$TOOLCHAIN" --profile minimal --component rustfmt --component clippy --target wasm32-unknown-unknown - name: Install lld run: sudo apt install -y lld clang gcc llvm - name: Install worker-build run: | set -euo pipefail if command -v worker-build &> /dev/null; then echo "worker-build already installed: $(worker-build --version || true)" fi cargo install --locked -q worker-build --version "${WORKER_BUILD_VERSION}" - name: Download and extract frontend (bw_web_builds) run: | set -euo pipefail TAG="${BW_WEB_VERSION}" if [ "${TAG}" = "latest" ]; then TAG="$(curl -s https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest | jq -r .tag_name)" fi echo "📦 Downloading frontend version: ${TAG}" # Download the web vault release wget -q "https://github.com/dani-garcia/bw_web_builds/releases/download/${TAG}/bw_web_${TAG}.tar.gz" # Extract to public/web-vault tar -xzf "bw_web_${TAG}.tar.gz" -C public/ # bw_web_builds extracts into a web-vault folder (expected) if [ ! -d "public/web-vault" ]; then echo "❌ Expected ./public/web-vault after extracting bw_web_builds" >&2 ls -la public/ | head -50 || true exit 1 fi # Remove large source maps to satisfy Cloudflare static asset per-file limits find public/web-vault -type f -name '*.map' -delete # Cleanup rm -f "bw_web_${TAG}.tar.gz" echo "✅ Frontend files extracted to ./public/web-vault" ls -la public/web-vault/ | head -20 - name: Apply web vault overrides (vaultwarden.css) run: | bash scripts/apply-web-vault-overrides.sh public/web-vault - name: Replace D1_DATABASE_ID_DEV in wrangler.toml run: sed -i "s/\${D1_DATABASE_ID_DEV}/${{ secrets.D1_DATABASE_ID_DEV }}/g" wrangler.toml - name: Enable R2 binding when R2_NAME_DEV is provided env: R2_NAME_DEV: ${{ secrets.R2_NAME_DEV }} run: | if [ -n "$R2_NAME_DEV" ]; then echo "🔧 Enabling dev R2 bucket binding" { echo '' echo '[[env.dev.r2_buckets]]' echo 'binding = "ATTACHMENTS_BUCKET"' echo "bucket_name = \"${R2_NAME_DEV}\"" } >> wrangler.toml else echo "⏭️ R2_NAME_DEV not set, skipping R2 binding" fi - name: Apply D1 database migrations (dev) run: | set -euo pipefail # Ensure pipe returns first non-zero exit code WRANGLER="npx --yes wrangler@${WRANGLER_VERSION}" # Apply migrations with retry loop to handle legacy ensure_schema columns MAX_RETRIES=10 RETRY_COUNT=0 while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do echo "🔄 Attempting to apply migrations (attempt $((RETRY_COUNT + 1))/$MAX_RETRIES)..." if $WRANGLER d1 migrations apply vault1 --env dev --remote 2>&1 | tee migration_output.txt; then echo "✅ All migrations applied successfully" exit 0 fi # Check if failure is due to duplicate column (from legacy ensure_schema) if grep -q "duplicate column name" migration_output.txt; then # Extract the migration name that failed # Format: "Migration 0001_add_password_salt.sql failed with the following errors:" FAILED_MIGRATION=$(grep -oP "Migration \K[0-9]+_[a-zA-Z0-9_]+\.sql(?= failed)" migration_output.txt) if [ -z "$FAILED_MIGRATION" ]; then echo "❌ Detected duplicate column error, but could not identify the migration filename from output." cat migration_output.txt exit 1 fi echo "⚠️ Migration '$FAILED_MIGRATION' failed: column already exists" echo "📝 Marking migration as applied..." # Initialize d1_migrations table and mark this migration as applied $WRANGLER d1 execute vault1 --env dev --remote --command " CREATE TABLE IF NOT EXISTS d1_migrations ( id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE NOT NULL, applied_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL ); INSERT OR IGNORE INTO d1_migrations (name) VALUES ('$FAILED_MIGRATION'); " RETRY_COUNT=$((RETRY_COUNT + 1)) echo "🔁 Retrying remaining migrations..." else echo "❌ Migration failed with unexpected error:" cat migration_output.txt exit 1 fi done echo "❌ Max retries ($MAX_RETRIES) exceeded" exit 1 - name: Seed global equivalent domains (dev, optional) env: SEED_GLOBAL_DOMAINS: ${{ vars.SEED_GLOBAL_DOMAINS || 'true' }} GLOBAL_DOMAINS_URL_DEV: ${{ vars.GLOBAL_DOMAINS_URL_DEV }} run: | set -euo pipefail if [ "${SEED_GLOBAL_DOMAINS}" = "false" ]; then echo "⏭️ SEED_GLOBAL_DOMAINS=false, skipping" exit 0 fi if [ -n "${GLOBAL_DOMAINS_URL_DEV:-}" ]; then bash scripts/seed-global-domains.sh --db vault1 --env dev --remote --wrangler-version "${WRANGLER_VERSION}" --url "${GLOBAL_DOMAINS_URL_DEV}" else bash scripts/seed-global-domains.sh --db vault1 --env dev --remote --wrangler-version "${WRANGLER_VERSION}" fi - uses: cloudflare/wrangler-action@v3 id: cf with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} wranglerVersion: ${{ env.WRANGLER_VERSION }} packageManager: npm command: deploy --env dev