deploy.yml

# Gearchiveerd: deze workflow bouwde de graph.json en de visualizer en zette ze op Bunny
# Storage/CDN (pce-poc.b-cdn.net). Sinds het archiveren (zie README) staan de automatische
# triggers hieronder uit, zodat er geen dagelijkse kosten meer lopen. De workflow zelf werkt
# nog gewoon: met `workflow_dispatch` kun je 'm handmatig starten om opnieuw naar Bunny te
# deployen, mits de secrets (PCE_POC_TOKEN, BUNNY_STORAGE_ZONE, BUNNY_STORAGE_PASSWORD,
# BUNNY_S3_ENDPOINT, BUNNY_API_KEY, BUNNY_PULLZONE_ID) nog geldig zijn.
name: PCE Visualizer bouwen en deployen

on:
  # Uitgeschakeld sinds het archiveren — draaide origineel dagelijks en bij elke push naar main:
  # schedule:
  #   - cron: '0 12 * * *'
  # push:
  #   branches:
  #     - main
  #   paths:
  #     - 'src/**'
  #     - 'public/**'
  #     - 'index.html'
  #     - 'package*.json'
  #     - 'tsconfig*.json'
  #     - 'vite.config.ts'
  #     - '.github/workflows/deploy.yml'
  workflow_dispatch:

concurrency:
  group: deploy
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  deploy:
    name: Graph en visualizer deployen
    runs-on: ubuntu-latest

    steps:
      - name: Broncode ophalen
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: PCE-PoC modules ophalen
        if: github.event_name != 'push'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ambutwente/PCE-PoC
          path: pce-poc
          token: ${{ secrets.PCE_POC_TOKEN }}

      - name: Node.js instellen
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: ${{ github.event_name != 'schedule' && 'npm' || '' }}
          cache-dependency-path: ${{ github.event_name != 'schedule' && 'package-lock.json' || '' }}

      - name: Graph genereren
        if: github.event_name != 'push'
        run: node scripts/generate-graph.mjs
        env:
          MODULES_DIR: ${{ github.workspace }}/pce-poc/modules

      - name: graph.json tonen
        if: github.event_name != 'push'
        run: cat public/graph.json

      - name: graph.json uploaden naar Bunny Storage (S3)
        if: github.event_name != 'push'
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.BUNNY_STORAGE_ZONE }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.BUNNY_STORAGE_PASSWORD }}
          AWS_DEFAULT_REGION: de
        run: |
          aws s3 cp public/graph.json \
            s3://${{ secrets.BUNNY_STORAGE_ZONE }}/graph.json \
            --endpoint-url ${{ secrets.BUNNY_S3_ENDPOINT }} \
            --no-progress \
            --cache-control "public, max-age=60, must-revalidate"

      - name: Visualizer URL tonen
        if: github.event_name != 'push'
        run: cat public/graph-url.txt

      - name: Dependencies installeren
        if: github.event_name != 'schedule'
        run: npm ci

      - name: Visualizer bouwen
        if: github.event_name != 'schedule'
        run: npm run build

      - name: Controleer dist inhoud
        if: github.event_name != 'schedule'
        run: ls -la dist/ && echo "--- index.html inhoud ---" && cat dist/index.html

      # Gehashte assets (index-<hash>.js, icon-chunks, ...) zijn immutable.
      # graph.json wordt door generate-graph beheerd en uitgesloten van --delete.
      - name: Assets synchroniseren naar Bunny Storage (S3)
        if: github.event_name != 'schedule'
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.BUNNY_STORAGE_ZONE }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.BUNNY_STORAGE_PASSWORD }}
          AWS_DEFAULT_REGION: de
        run: |
          aws s3 sync dist/ s3://${{ secrets.BUNNY_STORAGE_ZONE }}/ \
            --endpoint-url ${{ secrets.BUNNY_S3_ENDPOINT }} \
            --delete \
            --exact-timestamps \
            --no-progress \
            --exclude "graph.json" \
            --exclude "index.html" \
            --cache-control "public, max-age=31536000, immutable"

      - name: index.html uploaden (korte cache)
        if: github.event_name != 'schedule'
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.BUNNY_STORAGE_ZONE }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.BUNNY_STORAGE_PASSWORD }}
          AWS_DEFAULT_REGION: de
        run: |
          aws s3 cp dist/index.html \
            s3://${{ secrets.BUNNY_STORAGE_ZONE }}/index.html \
            --endpoint-url ${{ secrets.BUNNY_S3_ENDPOINT }} \
            --no-progress \
            --cache-control "public, max-age=60, must-revalidate"

      - name: Bunny CDN cache purgen
        if: github.event_name != 'schedule'
        env:
          BUNNY_API_KEY: ${{ secrets.BUNNY_API_KEY }}
          BUNNY_PULLZONE_ID: ${{ secrets.BUNNY_PULLZONE_ID }}
        run: |
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
            -X POST "https://api.bunny.net/pullzone/${BUNNY_PULLZONE_ID}/purgeCache" \
            -H "AccessKey: ${BUNNY_API_KEY}" \
            -H "Content-Type: application/json")
          echo "Bunny purge status: ${STATUS}"