# CI/CD Workflows

This project includes GitHub Actions workflows for continuous integration and deployment.

## Workflows

### Pull Request Checks (`lint-and-tests.yml`)

Runs on every pull request to `main`:
- Lints the codebase (`bun lint`)
- Runs tests (`bun test`)
- Uses dependency caching for faster builds

### Build and Deploy (`build-and-deploy.yml`)

Runs on pushes to `main` and after package publishing:
- Builds Docker images for changed scopes (apps/services)
- Pushes images to GitHub Container Registry (GHCR)
- Deploys infrastructure using Pulumi

## Required Secrets

Configure these secrets in your GitHub repository settings:

| Secret | Description |
|--------|-------------|
| `PULUMI_ACCESS_TOKEN` | Pulumi Cloud access token for infrastructure deployment |
| `DIGITALOCEAN_TOKEN` | DigitalOcean API token for DOKS/spaces access |

## Required Variables

Configure these variables in your GitHub repository settings:

| Variable | Description | Example |
|----------|-------------|---------|
| `PULUMI_STACK_BASE` | Base name for Pulumi stacks | `myorg/myproject` |

## Automatic Permissions

These are handled automatically via `permissions` in workflows:
- `GITHUB_TOKEN` - GitHub-provided token for GHCR push and API access

## Custom Actions

The workflows use these local actions:

| Action | Purpose |
|--------|---------|
| `setup-bun-install` | Setup Bun runtime with caching |
| `generate-scope-matrix` | Discover Docker-enabled scopes for matrix builds |
| `check-image-tag-exists` | Skip builds if image tag already exists in GHCR |
| `check-path-changes` | Detect file changes for conditional steps |
| `prepare-build-context` | Flatten turbo prune output for Docker builds |
| `resolve-scope-tags` | Map scope names to image tags for deployment |
| `detect-skipped-services` | Find services marked with `skip: true` in infra config |

## Infrastructure Configuration

Each service in `infra/services/*.ts` can be configured with:

```typescript
const config: K8sServiceConfig = {
  name: 'my-service',
  containerPort: 4001,
  skip: false, // Set to true to skip deployment
  // ... other config
}
```

Services with `skip: true` will be excluded from deployment.
