deploy-dev.js.yml

#
# Github Actions for Serverless Framework
#
# Create AWS_KEY and AWS_SECRET secrets in Github repository settings
# If you're using env.yml file, store its content as ENV Github secret
#
# Master branch will be deployed as DEV and every new tag starting with "v**" (e.g. v1.0, v1.2, v2.0, etc) will be deployed as PROD
#
# Learn more: https://maxkostinevich.com/blog/how-to-deploy-serverless-applications-using-github-actions/
#

name: Deploy Dev
on:
  push:
    branches:
      - develop
  repository_dispatch:
    types: [dep_update_dev]
  workflow_dispatch:

concurrency:
  group: deploy-dev
  cancel-in-progress: true

env:
    VAPID_PUBLIC_KEY: ${{ secrets.VAPID_PUBLIC_KEY }}
    VAPID_PRIVATE_KEY: ${{ secrets.VAPID_PRIVATE_KEY }}
    TOTP_KEY: ${{ secrets.TOTP_KEY }}
    OPENSSH_PRIVATE_KEY: ${{ secrets.OPENSSH_PRIVATE_KEY }}
    # Dev bot pool (us-east-1_kqlqXHDJ5) — separate from prod; update secrets after createBot / test-bot client rotation
    TEST_BOT_CLIENT_ID: ${{ secrets.TEST_BOT_CLIENT_ID }}
    TEST_BOT_CLIENT_SECRET: ${{ secrets.TEST_BOT_CLIENT_SECRET }}

jobs:
  deploy-dev:
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
    - uses: actions/checkout@v4
      with:
        ref: "develop"
        fetch-depth: 0
    - uses: actions/setup-node@v4
      with:
        node-version: 24

    - name: Pin npm
      run: npm install -g npm@11.6.2

    - name: Install Serverless Framework
      run: npm install -g serverless@3.40.0

    - name: Serverless AWS authentication
      run: sls config credentials --provider aws --key ${{ secrets.AWS_KEY }} --secret ${{ secrets.AWS_SECRET }}

    # - name: Create env file
    #   run: | # cp sample.env.yml env.yml
    #     cat > env.yml << EOF
    #     ${{ secrets.ENV }}
    #     EOF

    - name: Create .npmrc
      run: echo "@abstractplay:registry=https://npm.pkg.github.com/" > .npmrc
    - run: echo "//npm.pkg.github.com/:_authToken=${{secrets.PAT_READ_PACKAGES}}" >> .npmrc

    - name: Reject merge conflict markers in dep files
      run: |
        if grep -r '^<<<<<<<' package.json package-lock.json ci-deps.dev.json ci-deps.prod.json 2>/dev/null; then
          echo "Conflict markers found in dependency files"
          exit 1
        fi

    - name: Install NPM dependencies
      run: npm ci

    - name: Validate ci-deps manifests
      run: npx ap-check-ci-deps

    - name: Install pinned AP dependencies
      env:
        AP_GAMESLIB_VERSION: ${{ github.event.client_payload.gameslib_version }}
        AP_RENDERER_VERSION: ${{ github.event.client_payload.renderer_version }}
        AP_SOURCE: ${{ github.event.client_payload.source_run_id && format('gameslib-ci-{0}', github.event.client_payload.source_run_id) || '' }}
      run: npx ap-install-deps --stage dev

    - name: Verify lockfile matches ci-deps
      run: npx ap-check-ci-deps --stage dev --strict

    - name: Sync dependency manifests
      if: github.event_name == 'repository_dispatch'
      uses: stefanzweifel/git-auto-commit-action@v5
      with:
        commit_message: "deps: sync AP versions [skip ci]"
        file_pattern: |
          ci-deps.dev.json
          package-lock.json
          package.json

# --- MACHINE TRANSLATION PIPELINE START ---
    - name: Prune stale managed locale keys
      run: node bin/locale-prune.mjs locales/en/apback.json

    - name: Run Machine Translation on Locales
      env:
        GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
      run: node bin/translate.mjs locales/en/apback.json

    - name: Auto-commit Updated Translations Back to Branch
      uses: stefanzweifel/git-auto-commit-action@v5
      with:
        commit_message: "i18n: Auto-translate locale files [skip ci]"
        file_pattern: locales/de/ locales/fr/ locales/it/ locales/es-US/ locale-src/de/ locale-src/fr/ locale-src/it/ locale-src/es-US/
        disable_globbing: true

    - name: Verify locale-src was committed
      run: |
        if git status --porcelain locale-src/ | grep -q .; then
          echo "::error::locale-src/ has unstaged changes after auto-commit — sidecar stamps were not pushed"
          git status --porcelain locale-src/
          exit 1
        fi
# --- MACHINE TRANSLATION PIPELINE END ---

    - name: Set CI version
      run: npm version prerelease --preid=ci-$GITHUB_RUN_ID --no-git-tag-version

    - name: Build
      run: npm run build
      env:
        CI: false

    - name: Test (Lambda init smoke)
      run: npm test

    - name: Configure AWS credentials
      uses: Fooji/create-aws-profile-action@v1
      with:
        profile: AbstractPlayDev
        region: us-east-1
        key: ${{ secrets.AWS_KEY}}
        secret: ${{ secrets.AWS_SECRET}}
    #   uses: aws-actions/configure-aws-credentials@v2
    #   with:
    #     aws-access-key-id: ${{ secrets.AWS_KEY }}
    #     aws-secret-access-key: ${{ secrets.AWS_SECRET }}
    #     aws-region: us-east-1

    - name: Deploy
      run: bash bin/serverless-deploy.sh dev AbstractPlayDev

    - name: Trigger docs rebuild
      if: github.event_name == 'push'
      run: |
        BEFORE="${{ github.event.before }}"
        SHA="${{ github.sha }}"
        if [[ "$BEFORE" == "0000000000000000000000000000000000000000" ]]; then
          CHANGED=""
          for commit in ${{ join(github.event.commits.*.id, ' ') }}; do
            git fetch --depth=1 origin "$commit"
            CHANGED+="$(git show --name-only --pretty=format: "$commit")"$'\n'
          done
        else
          git fetch --depth=1 origin "$BEFORE"
          CHANGED="$(git diff --name-only "$BEFORE" "$SHA")"
        fi
        if echo "$CHANGED" | grep -q '^docs/'; then
          curl -L \
            -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${{ secrets.PAT_WORKFLOWS }}" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            https://api.github.com/repos/AbstractPlay/docs/dispatches \
            -d '{"event_type":"dep_update_dev"}'
        fi

    # Optional (to use with serverless-finch serverless plugin)
    #- name: Deploy assets to S3
    #  run: sls client deploy --no-delete-contents --no-confirm -s dev