name: Deploy templates

# Deploys the cloudflare-hosted starter kit demos at *.templates.tldraw.dev, which are the live
# embeds on the docs pages. Two things should reach them: a change to a template (so edits go live
# without waiting for a release), and a release (so the demos pick up the new SDK — an SDK bump
# never touches templates/, so the path filter alone would never fire for one). This workflow
# covers the first; publish.yml covers the second with a job of its own, using the same
# .github/actions/deploy-templates steps.
#
# The vercel-hosted demos (chat, shader, workflow) deploy through vercel's own git integration and
# aren't handled here.
on:
  push:
    branches:
      - main
    paths:
      - 'templates/**'
  workflow_dispatch:

defaults:
  run:
    shell: bash

permissions:
  contents: read

jobs:
  deploy:
    name: Deploy templates
    # CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID are secrets on this environment rather than on
    # the repository, so the job has to select it to see them at all.
    environment: deploy-production
    timeout-minutes: 60
    runs-on: ubuntu-latest-16-cores-arm-open
    # a release deploy and a template-change deploy can otherwise race each other onto the same
    # custom domains, and the loser silently wins.
    concurrency:
      group: deploy-templates
      cancel-in-progress: false

    steps:
      - name: Check out code
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - uses: ./.github/actions/deploy-templates
        with:
          license-key: ${{ secrets.TEMPLATES_TLDRAW_LICENSE_KEY }}
          cloudflare-account-id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          cloudflare-api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}

      - name: Notify Discord on failure
        if: failure()
        uses: ./.github/actions/discord-fail-notify
        with:
          webhook-url: ${{ secrets.DISCORD_DEPLOY_WEBHOOK_URL }}