snapshot of https://github.com/tldraw/tldraw.git (main, 2026-09-23; blobs > 131072B omitted)

.github/actions/deploy-templates/action.yml

@@ -0,0 +1,69 @@
+name: Deploy templates
+description: >
+  Build the starter-kit demos against the checked-out SDK and deploy the cloudflare-hosted ones to
+  *.templates.tldraw.dev. Shared by deploy-templates.yml (template changes, manual runs) and
+  publish.yml (releases). Expects the repo to be checked out already; runs the setup action itself.
+
+# The cloudflare credentials are secrets on the deploy-production environment, so the job using
+# this action has to select that environment and pass them in. This is a composite action rather
+# than a workflow_call workflow because a called workflow only ever sees the secrets its caller
+# hands it, and an `environment:` on a job inside the callee does not add that environment's
+# secrets to them — see #10636.
+inputs:
+  license-key:
+    description: tldraw license key the demos are built with (TEMPLATES_TLDRAW_LICENSE_KEY)
+    required: true
+  cloudflare-account-id:
+    description: Cloudflare account the workers deploy to (CLOUDFLARE_ACCOUNT_ID)
+    required: true
+  cloudflare-api-token:
+    description: Cloudflare API token with workers permissions (CLOUDFLARE_API_TOKEN)
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup
+
+    # most templates run `tsc` as part of their build, which resolves the workspace packages
+    # through their project references and so needs the declarations built first
+    - name: Build types
+      shell: bash
+      env:
+        # build-types pulls in refresh-assets, which rewrites the generated version files. in CI it
+        # exits 1 on any change to a committed asset instead of writing it, which would fail the
+        # deploy on a release ref whose generated files aren't already in sync.
+        ALLOW_REFRESH_ASSETS_CHANGES: 1
+      run: yarn build-types
+
+    - name: Deploy templates
+      shell: bash
+      env:
+        CI: 1
+        PRINT_GITHUB_ANNOTATIONS: 1
+        ALLOW_REFRESH_ASSETS_CHANGES: 1
+        TEMPLATES_TLDRAW_LICENSE_KEY: ${{ inputs.license-key }}
+        CLOUDFLARE_API_TOKEN: ${{ inputs.cloudflare-api-token }}
+        CLOUDFLARE_ACCOUNT_ID: ${{ inputs.cloudflare-account-id }}
+      run: |
+        # the templates import tldraw/tldraw.css, which is generated and gitignored
+        yarn lazy prebuild
+
+        cd templates
+        all_templates=$(ls -d */ | cut -f1 -d'/')
+        cd ..
+
+        # the demos are independent of each other, so deploy them all before failing: one broken
+        # template shouldn't leave the rest stranded on an old build with no signal about which.
+        # templates with no `deploy` config in their package.json skip themselves.
+        failed=""
+        for template in $all_templates; do
+          echo "::group::Deploying $template"
+          yarn tsx ./internal/scripts/deploy-template.ts $template || failed="$failed $template"
+          echo "::endgroup::"
+        done
+
+        if [ -n "$failed" ]; then
+          echo "::error::Failed to deploy templates:$failed"
+          exit 1
+        fi

.github/actions/discord-fail-notify/action.yml

@@ -0,0 +1,32 @@
+name: Discord fail notify
+description: Post a failure message to the Discord deploy/health channel.
+
+inputs:
+  webhook-url:
+    description: Discord webhook URL
+    required: true
+  status:
+    description: What happened to the workflow, used in the message verb
+    required: false
+    default: failed
+
+runs:
+  using: composite
+  steps:
+    - name: Notify Discord
+      shell: bash
+      env:
+        DISCORD_WEBHOOK_URL: ${{ inputs.webhook-url }}
+        WORKFLOW: ${{ github.workflow }}
+        REF: ${{ github.ref_name }}
+        STATUS: ${{ inputs.status }}
+        RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      run: |
+        if [ -z "$DISCORD_WEBHOOK_URL" ]; then
+          echo "::warning::DISCORD_WEBHOOK_URL is empty; skipping Discord notification."
+          exit 0
+        fi
+        payload=$(jq -nc \
+          --arg content "<@&1414904550917144586> ❌ **${WORKFLOW}** ${STATUS} on \`${REF}\`: <${RUN_URL}>" \
+          '{content: $content}')
+        curl -fsS -X POST -H "Content-Type: application/json" -d "$payload" "$DISCORD_WEBHOOK_URL"

.github/actions/setup-playwright/action.yml

@@ -0,0 +1,46 @@
+name: 'Setup Playwright'
+description: 'Install Playwright browsers with version-keyed caching shared across workflows.'
+
+inputs:
+  browsers:
+    description: 'Space-separated Playwright browsers to install and cache.'
+    required: false
+    # Only bundled Chromium by default — every e2e project uses `devices['Desktop Chrome']` /
+    # `['Pixel 5']` with no `channel`, so the branded `chrome` build is never launched.
+    default: 'chromium'
+
+runs:
+  using: 'composite'
+  steps:
+    # @playwright/test is hoisted to the root node_modules (it's a devDependency of the e2e
+    # workspaces), so Node resolves it from the repo root — no per-workspace cwd, nothing written
+    # to the tree. We also derive a key-safe browser token (spaces -> dashes) so multi-browser
+    # values like "chromium firefox" don't put a space in the cache key.
+    - name: Resolve Playwright version and browsers
+      shell: bash
+      env:
+        BROWSERS: ${{ inputs.browsers }}
+      run: |
+        echo "PLAYWRIGHT_VERSION=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_ENV"
+        echo "PLAYWRIGHT_BROWSERS_KEY=$(echo "$BROWSERS" | tr ' ' '-')" >> "$GITHUB_ENV"
+
+    # Keyed on os + arch + version + browsers. The arch matters (ARM vs x64 need different
+    # binaries); the browser set matters too — without it, adding a browser would be a stale cache
+    # hit that skips the install and never downloads the new one.
+    - name: Check for Playwright browsers cache
+      id: playwright-cache
+      uses: actions/cache@v5
+      with:
+        path: |
+          ~/.cache/ms-playwright
+        key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ env.PLAYWRIGHT_VERSION }}-${{ env.PLAYWRIGHT_BROWSERS_KEY }}
+
+    # Cache miss only. `--with-deps` also installs the OS libraries the browsers need — a no-op for
+    # Chromium on GitHub's runner images, but it means adding webkit/firefox via `browsers` later
+    # just works without extra setup.
+    - name: Install Playwright browsers
+      if: steps.playwright-cache.outputs.cache-hit != 'true'
+      shell: bash
+      env:
+        BROWSERS: ${{ inputs.browsers }}
+      run: npx playwright install --with-deps $BROWSERS

.github/actions/setup/action.yml

@@ -0,0 +1,39 @@
+name: Setup tldraw/tldraw
+description: Set up node & yarn
+
+runs:
+  using: composite
+  steps:
+    # see https://github.com/actions/setup-node/issues/899 for one of the reasons why this
+    # needs to be done before action/setup-node
+    - name: Enable corepack
+      run: npm i -g corepack
+      shell: bash
+
+    - name: Setup Node.js Environment
+      id: setup-node
+      uses: actions/setup-node@v6
+      with:
+        node-version: 24.17.0
+
+    - name: Restore node_modules cache
+      uses: actions/cache@v5
+      id: node-modules-cache
+      with:
+        path: |
+          node_modules
+          **/node_modules
+          .yarn/cache
+          .yarn/unplugged
+          .yarn/install-state.gz
+        key: ${{ runner.os }}-${{ runner.arch }}-node-${{ steps.setup-node.outputs.node-version }}-yarn-${{ hashFiles('yarn.lock', '.yarnrc.yml', '.yarn/patches/*') }}
+        restore-keys: |
+          ${{ runner.os }}-${{ runner.arch }}-node-${{ steps.setup-node.outputs.node-version }}-yarn-
+
+    - name: Install dependencies
+      run: yarn install --immutable
+      shell: bash
+      env:
+        # Hardened mode enables --check-resolutions on public PRs, adding ~15s.
+        # See https://yarnpkg.com/features/security - Yarn recommends disabling in most jobs.
+        YARN_ENABLE_HARDENED_MODE: 0