BANDA-899 chore: add GitHub Actions workflow to deploy Workers (#160)

also refactored the existing workflows a bit

Author: jahands

.changeset/config.json

@@ -7,5 +7,9 @@
 	"access": "restricted",
 	"baseBranch": "main",
 	"updateInternalDependencies": "patch",
-	"ignore": []
+	"ignore": [],
+	"privatePackages": {
+		"version": true,
+		"tag": true
+	}
 }

.changeset/proud-gifts-end.md

@@ -0,0 +1,5 @@
+---
+'@repo/tools': minor
+---
+
+BANDA-899 feat: add runx deploy-published-workers script

.github/actions/setup/action.yml

@@ -0,0 +1,25 @@
+name: 'Setup Node.js Environment'
+description: 'Install pnpm, Node.js, and project dependencies'
+
+inputs:
+  node-version:
+    description: 'Node.js version to use'
+    required: false
+    default: '22'
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install pnpm
+      # note: version is inferred from the packageManager field in package.json
+      uses: pnpm/action-setup@v4
+
+    - name: Use Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: 'pnpm'
+
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile --child-concurrency=10

.github/workflows/test-and-check.yml renamed to .github/workflows/branches.yml

@@ -1,26 +1,27 @@
-name: Test and check
+name: Branches
 on:
   push:
+    branches-ignore: ['main']
+
+env:
+  FORCE_COLOR: 1
 
 jobs:
   test:
+    name: Test & Check
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    timeout-minutes: 10
     strategy:
       matrix:
         node-version: [20, 22]
     steps:
       - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10.8.0
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+      - uses: ./.github/actions/setup
         with:
           node-version: ${{ matrix.node-version }}
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile --child-concurrency=10
+
       - name: Syncpack lint
         run: pnpm check:deps
       - name: Run linter
@@ -29,3 +30,4 @@ jobs:
         run: pnpm check:format
       - name: Run tests
         run: pnpm test
+

.github/workflows/evals.yml

@@ -2,23 +2,19 @@ name: Evals
 on:
   push:
 
+env:
+  FORCE_COLOR: 1
+
 jobs:
   eval:
+    name: Eval
     runs-on: ubuntu-24.04
-    strategy:
-      matrix:
-        node-version: [22]
+    permissions:
+      contents: read
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10.8.0
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: 'pnpm'
+      - uses: ./.github/actions/setup
       - name: Create .dev.vars file
         run: |
           echo "OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}" > ./apps/sandbox-container/.dev.vars
@@ -29,7 +25,5 @@ jobs:
         run: |
           du -h ./apps/sandbox-container/.dev.vars
           du -h ./apps/workers-bindings/.dev.vars
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile --child-concurrency=10
       - name: Run evals
         run: pnpm eval:ci

.github/workflows/main.yml

@@ -0,0 +1,37 @@
+name: Main
+
+on:
+  push:
+    branches: ['main']
+
+env:
+  FORCE_COLOR: 1
+
+jobs:
+  deploy-staging:
+    name: Deploy (staging)
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    timeout-minutes: 10
+    concurrency: ${{ github.workflow }}-deploy-staging
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+
+      # Run tests & checks before deploying
+      - name: Syncpack lint
+        run: pnpm check:deps
+      - name: Run linter
+        run: pnpm check:turbo
+      - name: Run linter (formatting)
+        run: pnpm check:format
+      - name: Run tests
+        run: pnpm test
+
+      - name: Deploy Workers (staging)
+        run: pnpm turbo deploy -- -e staging
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,66 @@
+name: Release
+
+on:
+  push:
+    branches: ['main']
+
+env:
+  FORCE_COLOR: 1
+
+jobs:
+  create-release-pr:
+    name: Create Release PR
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      pull-requests: write
+    timeout-minutes: 5
+    concurrency: ${{ github.workflow }}-create-release-pr
+    outputs:
+      published: ${{ steps.create-release-pr.outputs.published }}
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+      - name: Create Release PR
+        id: create-release-pr
+        uses: changesets/action@v1
+        with:
+          publish: pnpm changeset publish
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Save Published Packages
+        if: steps.create-release-pr.outputs.published == 'true'
+        run: |
+          echo '${{steps.create-release-pr.outputs.publishedPackages}}' \
+            > ${{ github.workspace }}/published-packages.json
+      - name: Upload Published Packages
+        if: steps.create-release-pr.outputs.published == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: published-packages
+          path: ${{ github.workspace }}/published-packages.json
+
+  deploy-production:
+    name: Deploy (production)
+    needs: create-release-pr
+    if: needs.create-release-pr.outputs.published == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    concurrency: ${{ github.workflow }}-deploy-production
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+      - name: Download published packages
+        uses: actions/download-artifact@v4
+        with:
+          name: published-packages
+          path: ${{ runner.temp }}
+      - uses: ./.github/actions/setup
+      - name: Deploy Published Workers (production)
+        run: pnpm runx deploy-published-workers --env production
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

.prettierignore

@@ -5,3 +5,4 @@ vitest.config.ts.timestamp*
 vite.config.ts.timestamp*
 worker-configuration.d.ts
 **/dist/**
+packages/tools/src/test/fixtures/changesets/invalid-json/*.json

.syncpackrc.cjs

@@ -45,6 +45,12 @@ const config = {
 			// snapTo removes it from syncpack update list, which is the main goal
 			snapTo: ['@repo/eslint-config'],
 		},
+		{
+			label: 'use zod v4 in packages/tools',
+			dependencies: ['zod'],
+			pinVersion: '4.0.0-beta.20250505T195954',
+			packages: ['@repo/tools'],
+		},
 	],
 	semverGroups: [
 		{

packages/tools/.eslintrc.cjs

@@ -0,0 +1,5 @@
+/** @type {import("eslint").Linter.Config} */
+module.exports = {
+	root: true,
+	extends: ['@repo/eslint-config/default.cjs'],
+}

packages/tools/README.md

@@ -0,0 +1,36 @@
+# @repo/tools
+
+A collection of shared scripts for automating the monorepo while ensuring consistency across packages.
+
+## Scripts
+
+### Bin Scripts
+
+Simple shell scripts for common development tasks:
+
+- `run-tsc`: Run TypeScript type checking
+- `run-eslint-workers`: Run ESLint checks
+- `run-vitest`: Run tests
+- `run-vitest-ci`: Run tests in CI mode
+- `run-turbo`: Run Turbo commands with tracking disabled
+- `run-wrangler-deploy`: Deploy using Wrangler
+- `run-wrangler-types`: Generate Wrangler types
+- `run-fix-deps`: Fix dependencies
+
+### Runx CLI
+
+A TypeScript-based CLI for more complex automation tasks. While the bin scripts work well for simple tasks, the runx CLI provides better type safety and more sophisticated programmatic control.
+
+Usage:
+
+```bash
+pnpm runx <command> [options]
+```
+
+Available commands:
+
+- `deploy-published-workers`: Deploy Cloudflare Workers (based on which packages changesets marked as published in the release).
+
+Note:
+
+The CLI will automatically use Bun if available, but falls back to tsx if not installed.

packages/tools/bin/runx

@@ -0,0 +1,13 @@
+#!/usr/bin/env sh
+set -eu
+
+script_path="$(realpath "$(dirname "$0")/../src/bin/runx.ts")"
+
+bin_dir="$(realpath "$(dirname "$0")")"
+tsx_path="$(realpath "$bin_dir/../node_modules/.bin/tsx")"
+
+if command -v bun >/dev/null 2>&1; then
+	bun "$script_path" "$@"
+else
+	"$tsx_path" "$script_path" "$@"
+fi

packages/tools/package.json

@@ -8,6 +8,17 @@
 		"bin": "bin"
 	},
 	"devDependencies": {
-		"@types/node": "22.14.1"
+		"@types/fs-extra": "11.0.4",
+		"@types/node": "22.14.1",
+		"vitest": "3.0.9"
+	},
+	"dependencies": {
+		"@commander-js/extra-typings": "13.1.0",
+		"@jahands/cli-tools": "0.10.2",
+		"commander": "13.1.0",
+		"empathic": "1.1.0",
+		"tsx": "4.19.3",
+		"zod": "4.0.0-beta.20250505T195954",
+		"zx": "8.5.4"
 	}
 }

packages/tools/src/bin/runx.ts

@@ -0,0 +1,20 @@
+import 'zx/globals'
+
+import { program } from '@commander-js/extra-typings'
+import { catchProcessError } from '@jahands/cli-tools'
+
+import { deployPublishedWorkersCmd } from '../cmd/deploy-published-packages'
+
+program
+	.name('runx')
+	.description('A CLI for scripts that automate this repo')
+
+	// While `packages/tools/bin` scripts work well for simple tasks,
+	// a typescript CLI is nicer for more complex things.
+
+	.addCommand(deployPublishedWorkersCmd)
+
+	// Don't hang for unresolved promises
+	.hook('postAction', () => process.exit(0))
+	.parseAsync()
+	.catch(catchProcessError())