deploy-docs.yml

name: Deploy docs

# Unversioned /persist FTP. `docs` label = deploy on merge without waiting for a package release.
on:
  workflow_dispatch:
  release:
    types: [published]
  pull_request:
    types: [closed]
    branches: [main]

permissions:
  contents: read

# Single FTP root — don't overlap uploads.
concurrency:
  group: deploy-docs-production
  cancel-in-progress: false

jobs:
  deploy:
    name: 🚀 Build & Deploy docs (FTP)
    if: >
      github.event_name == 'workflow_dispatch' ||
      github.event_name == 'release' ||
      (github.event_name == 'pull_request' &&
       github.event.pull_request.merged == true &&
       contains(github.event.pull_request.labels.*.name, 'docs'))
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false
          # Closed PR checkout defaults to a dead merge ref — pin the merge commit on main.
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.merge_commit_sha || github.sha }}
          # Sitemap lastmod uses `git log` per file.
          fetch-depth: 0

      - name: Setup Bun
        uses: ./.github/actions/setup

      # Lib dist — cheap; keep for parity / future islands that resolve package entrypoints.
      - name: Build
        run: bun run build

      - name: Generate API reference (Markdown)
        run: bun run docs:api

      # Same gates as CI `docs` — workflow_dispatch must not FTP an unaudited tree.
      - name: Validate docs links
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bun run docs:validate -- --strict

      - name: Typecheck docs site
        run: bun run docs:check -- --isolated

      - name: Build docs site
        env:
          # Changelog github-releases source + avoid unauthenticated API rate limits.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bun run docs:build

      - name: Audit docs site
        run: bun run docs:audit

      # FTP account root is already /persist — server-dir ./ is correct (not ./persist/).
      - name: Upload to /persist via FTP
        uses: SamKirkland/FTP-Deploy-Action@v4.4.0
        with:
          server: ${{ secrets.FTP_HOST }}
          username: ${{ secrets.FTP_USERNAME }}
          password: ${{ secrets.FTP_PASSWORD }}
          protocol: ftps
          port: 21
          security: strict
          local-dir: ./apps/docs/dist/
          server-dir: ./
          exclude: |
            **/.git*
            **/.git*/**
            **/node_modules/**