deploy-web.yml

name: deploy-web

# Deploy the public site (skill-map.ai) to Railway only when a
# versioned bump or infra change occurs:
#
#   - web/package.json    bump of @skill-map/web (landing/demo source)
#   - spec/package.json   bump of @skill-map/spec (schemas served at /spec/v0/)
#   - Dockerfile          deploy recipe
#   - Caddyfile           server config
#
# In-flight changes to web/, ui/, spec/, fixtures/demo-scope/, etc. do
# NOT trigger a deploy on merge. They ride along the next "chore: version
# packages" PR that consumes the changesets and bumps web/spec/package.json.
# That keeps each deploy aligned with a released version, and avoids the
# double-deploy that happens when both the feature merge AND the version
# bump fire the workflow back-to-back.
#
# To preview an in-flight change, use `pnpm web:dev` locally.
#
# Setup (one-time, all in GitHub repo Settings → Secrets and variables → Actions):
#   1. Secrets tab → New repository secret `RAILWAY_API_TOKEN` with an
#      account-level Account Token from Railway (Account Settings →
#      Tokens). Account tokens auth the CLI; the project + service are
#      selected explicitly via `railway link` below.
#   2. Secrets tab → New repository secret `RAILWAY_PROJECT_ID` with the
#      project UUID (Railway dashboard → Project → Settings).
#   3. Variables tab → New repository variable `RAILWAY_SERVICE` with the
#      service UUID of the skill-map service in that project.
#   4. Disconnect the GitHub ↔ Railway auto-deploy integration in the
#      Railway dashboard so the only deploy path is this workflow.

on:
  # Manual force-deploy: from the Actions tab ("Run workflow") or
  # `gh workflow run deploy-web.yml --ref main`. Deploys whatever is on
  # `main` to Railway, e.g. to refresh the public demo with the latest UI
  # without waiting for a version-packages release. Reads the CURRENT
  # web/package.json version for the deploy label.
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - 'web/package.json'
      - 'spec/package.json'
      - 'Dockerfile'
      - 'Caddyfile'

concurrency:
  group: deploy-web-${{ github.ref }}
  cancel-in-progress: false

jobs:
  read-version:
    name: read web version
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.read.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Read web/package.json version
        id: read
        run: echo "version=v$(node -p "require('./web/package.json').version")" >> $GITHUB_OUTPUT

  deploy:
    name: ${{ needs.read-version.outputs.version }}
    needs: read-version
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      # No `actions/setup-node` / `pnpm/action-setup`: this workflow
      # never runs `pnpm install`. The previous combo wired pnpm just
      # so setup-node@v5 wouldn't choke on the repo's `packageManager`
      # field, but pnpm/action-setup@v6 caches the pnpm store on
      # post-job cleanup, and since the store never gets populated
      # here the cleanup raised "Path Validation Error: Path(s)
      # specified in the action for caching do(es) not exist". The
      # node + npm preinstalled on `ubuntu-latest` satisfy both real
      # needs of this job: `npm install -g @railway/cli` below and
      # the `node -p` in the read-version job.

      - name: Install Railway CLI
        run: npm install -g @railway/cli

      - name: Show version
        run: echo "Deploying @skill-map/web ${{ needs.read-version.outputs.version }} to service ${{ vars.RAILWAY_SERVICE }}"

      - name: Link Railway project
        env:
          RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
        run: railway link -p ${{ secrets.RAILWAY_PROJECT_ID }} -s ${{ vars.RAILWAY_SERVICE }} --environment production

      - name: Deploy ${{ needs.read-version.outputs.version }}
        env:
          RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
        run: railway up -s ${{ vars.RAILWAY_SERVICE }} -m "${{ needs.read-version.outputs.version }}"