name: 部署文档（Cloudflare Pages）

on:
  push:
    branches: [main]
    paths:
      - "index.html"
      - "_sidebar.md"
      - "README.md"
      - "docs/**"
      - "examples/**"
      - "CHANGELOG.md"
      - "scripts/deploy_docs.sh"
      - ".gitea/workflows/deploy-docs.yml"
  workflow_dispatch:

jobs:
  deploy-docs:
    name: Cloudflare Pages
    runs-on: ubuntu-latest
    steps:
      # 不用 actions/checkout、不用 git（runner 对 github 连通性不稳，见
      # probe.yml）：改走 Gitea archive 接口拉源码 tarball
      - name: 拉源码
        run: |
          SERVER="${GITHUB_SERVER_URL:-https://gitea.4i.hk}"
          curl -sL "$SERVER/api/v1/repos/$GITHUB_REPOSITORY/archive/$GITHUB_SHA.tar.gz" -o src.tgz \
            && mkdir src && tar -xzf src.tgz -C src --strip-components=1 \
            && mv src/* . && rm -rf src src.tgz

      # 日志匿名不可读：把 secrets 在场情况写进 commit status 便于远程
      # 排查（只报 set/MISSING，不泄露值）
      - name: 探测 secrets 是否配置
        env:
          TOKEN: ${{ secrets.GITEA_TOKEN }}
          CF_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CF_ACCOUNT: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          SERVER="${GITHUB_SERVER_URL:-https://gitea.4i.hk}"
          s() { [ -n "$2" ] && echo set || echo MISSING; }
          curl -s -m 10 -X POST \
            -H "Authorization: token $TOKEN" \
            -H 'Content-Type: application/json' \
            -d "{\"state\":\"success\",\"context\":\"deploy/secrets\",\"description\":\"CLOUDFLARE_API_TOKEN=$(s x "$CF_TOKEN") CLOUDFLARE_ACCOUNT_ID=$(s x "$CF_ACCOUNT")\"}" \
            "$SERVER/api/v1/repos/$GITHUB_REPOSITORY/statuses/$GITHUB_SHA" -o /dev/null

      - name: 组装并部署（wrangler Direct Upload）
        run: bash scripts/deploy_docs.sh
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}