chore(deps): refresh lockfile from fleet cascade #40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🌐 Deploy (Val Town) | |
| # Deploys the comment backend val to Val Town when val source | |
| # changes on main. Also runnable manually via workflow_dispatch. | |
| # | |
| # One-time setup required in the repo settings: | |
| # ───────────────────────────────────────────── | |
| # 1. Mint a Val Town API token (val.town → Settings → API Tokens). | |
| # Scope: val:write only — nothing broader. No blob, no user. | |
| # Write down the token; Val Town won't show it again. | |
| # | |
| # 2. Store it as a GitHub repository secret: | |
| # Settings → Secrets and variables → Actions → New | |
| # Name: VALTOWN_TOKEN | |
| # Value: the token from step 1. | |
| # | |
| # 3. Initialize the comment-store wrapping key: | |
| # meander db key init | |
| # This generates the wrapping key, Shamir-splits it across | |
| # custodians, and plants MEANDER_DB_KEY_1 + | |
| # MEANDER_DB_KEY_CURRENT directly on the val. deploy-val | |
| # does not touch wrapping keys. | |
| # | |
| # 4. Optional: if encryptBlobs: true in meander.config.json, | |
| # run `meander blob key init` to plant MEANDER_BLOB_KEY on | |
| # the val. Otherwise blobs are served plaintext. | |
| # | |
| # 5. Optional: set MEANDER_ALLOWED_EMAIL_DOMAINS as a repo | |
| # variable (not a secret — it's a non-sensitive comma- | |
| # separated list). Without it, the val refuses every write. | |
| # | |
| # 6. Rotate the API token by repeating 1-2 and deleting the | |
| # old token in Val Town. Wrapping keys rotate independently | |
| # via `meander db key rotate` / `meander blob key rotate`. | |
| # | |
| # The workflow never logs the token. Job-level env scope means | |
| # only the deploy job sees it; fork PRs are excluded (secrets | |
| # aren't plumbed to pull_request triggers, and we don't declare | |
| # one here). | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'assets/val/**' | |
| - 'src/deploy-val.mts' | |
| - 'src/publish.mts' | |
| - '.github/workflows/valtown.yml' | |
| - '.github/actions/**' | |
| - '.config/repo/external-tools.json' | |
| - 'package.json' | |
| - 'pnpm-lock.yaml' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # Queue deploys serially. Never cancel mid-deploy — a partial | |
| # upload can leave Val Town mixing old + new file versions. | |
| concurrency: | |
| group: valtown | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| name: Upload val files to Val Town | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| # Job-level scope — only this job sees the secrets. Anything | |
| # we add later runs without them unless explicitly granted. | |
| VALTOWN_TOKEN: ${{ secrets.VALTOWN_TOKEN }} | |
| # Non-secret — allowed-domains is not sensitive. Stored as a | |
| # repo *variable*, not a secret, so it shows up in CI logs | |
| # (you WANT to see which domains the deploy enabled). | |
| MEANDER_ALLOWED_EMAIL_DOMAINS: ${{ vars.MEANDER_ALLOWED_EMAIL_DOMAINS }} | |
| steps: | |
| - name: Preflight — verify VALTOWN_TOKEN is configured | |
| # Fail fast with a clear message if the token is missing. | |
| # Runs BEFORE any setup so a misconfigured repo doesn't | |
| # waste install time. Wrapping keys aren't checked here — | |
| # they're managed via `meander db key init` / `meander | |
| # blob key init`, run once by an operator, not per-deploy. | |
| run: | | |
| if [ -z "$VALTOWN_TOKEN" ]; then | |
| echo "::error::VALTOWN_TOKEN secret is not configured." | |
| echo "::error::See .github/workflows/valtown.yml header for setup steps." | |
| exit 1 | |
| fi | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15) | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: Setup and install | |
| uses: ./.github/actions/fleet/setup-and-install | |
| - name: Build (emits dist/cli.mjs) | |
| run: pnpm run build | |
| - name: Deploy val | |
| # Uses the built CLI's deploy-val command which uploads | |
| # assets/val/index.ts to the target val, creating it if | |
| # missing, and pushes the env vars the val needs. | |
| run: pnpm exec meander deploy-val |