name: Deploy Worker

on:
  push:
    branches:
      - main
    paths:
      - 'worker/**'
      - '.github/workflows/deploy-worker.yml'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Deploy Worker
        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          workingDirectory: worker

      - name: Verify route is bound and Worker responds
        env:
          # Must match the hostname in worker/wrangler.toml's route.
          PROBE_HOST: pkg.claude-desktop-debian.dev
        run: |
          # Wait briefly for deploy + DNS propagation
          sleep 30

          # Worker proxies metadata path through to gh-pages; expect any
          # 2xx/3xx. A 5xx or 521/523/530 means the route isn't bound or
          # the Worker errored at edge.
          status=$(curl -s -o /dev/null -w '%{http_code}' \
            --max-time 30 \
            "https://${PROBE_HOST}/dists/stable/InRelease")
          echo "Probe status: ${status}"
          if [[ ! "$status" =~ ^[23] ]]; then
            echo "::error::Worker probe at ${PROBE_HOST} returned ${status}"
            echo "::error::Expected 2xx or 3xx (route bound + Worker responding)"
            exit 1
          fi
          echo "Route bound, Worker responding."