mcp-use__mcp-use/.github/workflows/railway-deploy.yml

name: Railway Deploy

on:
  workflow_run:
    workflows: ["TypeScript Release"]
    types:
      - completed
  workflow_dispatch:
    inputs:
      branch:
        description: 'Branch to deploy from (canary or main)'
        required: true
        type: choice
        options:
          - canary
          - main

jobs:
  deploy:
    name: Deploy to Railway
    runs-on: ubuntu-latest
    # For workflow_run: only run if the release workflow completed successfully
    # For workflow_dispatch: always run
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    permissions:
      actions: read
    steps:
      - name: Determine branch (manual trigger)
        if: github.event_name == 'workflow_dispatch'
        id: branch-info
        env:
          INPUT_BRANCH: ${{ github.event.inputs.branch }}
        run: |
          BRANCH="$INPUT_BRANCH"
          echo "branch=$BRANCH" >> $GITHUB_OUTPUT
          echo "packages_published=true" >> $GITHUB_OUTPUT
          echo "✅ Manual deployment triggered for branch: $BRANCH"

      - name: Validate workflow run source (automatic trigger)
        if: github.event_name == 'workflow_run'
        uses: actions/github-script@v7
        id: validate-source
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          script: |
            // Validate that the workflow_run is from the same repository (not a fork)
            const workflowRun = context.payload.workflow_run;
            const isSameRepo = workflowRun.repository.full_name === `${context.repo.owner}/${context.repo.repo}`;
            
            if (!isSameRepo) {
              core.setFailed(`❌ Security: Workflow run is from a different repository (${workflowRun.repository.full_name}). Only runs from ${context.repo.owner}/${context.repo.repo} are allowed.`);
              return;
            }
            
            core.info(`✅ Workflow run validated: ${workflowRun.repository.full_name}`);
            core.setOutput('is_valid', 'true');

      - name: Check for deployment marker (automatic trigger)
        if: github.event_name == 'workflow_run' && steps.validate-source.outputs.is_valid == 'true'
        uses: actions/github-script@v7
        id: check-marker
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          script: |
            const { data: artifacts } = await github.rest.actions.listWorkflowRunArtifacts({
              owner: context.repo.owner,
              repo: context.repo.repo,
              run_id: context.payload.workflow_run.id,
            });
            
            const marker = artifacts.artifacts.find(a => a.name === 'railway-deploy-marker');
            
            if (!marker) {
              core.setOutput('packages_published', 'false');
              core.info('⚠️ No deployment marker found - packages were not published, skipping deployment');
              return;
            }
            
            core.setOutput('packages_published', 'true');
            core.setOutput('artifact_id', marker.id);
            core.info('✅ Deployment marker found - packages were published');

      - name: Download and parse marker file (automatic trigger)
        if: github.event_name == 'workflow_run' && steps.check-marker.outputs.packages_published == 'true'
        uses: actions/github-script@v7
        id: marker-info
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ARTIFACT_ID: ${{ steps.check-marker.outputs.artifact_id }}
        with:
          script: |
            const { data: download } = await github.rest.actions.downloadArtifact({
              owner: context.repo.owner,
              repo: context.repo.repo,
              artifact_id: parseInt(process.env.ARTIFACT_ID),
              archive_format: 'zip',
            });
            
            const fs = require('fs');
            const { execSync } = require('child_process');
            const path = require('path');
            
            // Save zip file
            const zipPath = path.join(process.env.RUNNER_TEMP, 'marker.zip');
            fs.writeFileSync(zipPath, Buffer.from(download));
            
            // Extract zip using unzip command
            const extractPath = path.join(process.env.RUNNER_TEMP, 'marker');
            fs.mkdirSync(extractPath, { recursive: true });
            execSync(`unzip -q "${zipPath}" -d "${extractPath}"`);
            
            // Read marker file
            const markerPath = path.join(extractPath, '.railway-deploy-marker');
            const markerContent = fs.readFileSync(markerPath, 'utf8');
            
            // Parse branch from marker
            const branchMatch = markerContent.match(/branch=(.+)/);
            const branch = branchMatch ? branchMatch[1].trim() : null;
            
            core.setOutput('branch', branch);
            core.info(`📦 Branch from marker: ${branch}`);

      - name: Determine Service ID
        id: config
        if: |
          (github.event_name == 'workflow_dispatch') ||
          (github.event_name == 'workflow_run' && steps.validate-source.outputs.is_valid == 'true' && steps.check-marker.outputs.packages_published == 'true')
        env:
          EVENT_NAME: ${{ github.event_name }}
          BRANCH_INFO_BRANCH: ${{ steps.branch-info.outputs.branch }}
          MARKER_INFO_BRANCH: ${{ steps.marker-info.outputs.branch }}
        run: |
          # Get branch from either manual trigger or automatic trigger
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            BRANCH="$BRANCH_INFO_BRANCH"
          else
            BRANCH="$MARKER_INFO_BRANCH"
          fi
          
          if [ "$BRANCH" = "canary" ]; then
            echo "service_id=${{ secrets.RAILWAY_SERVICE_ID_CANARY }}" >> $GITHUB_OUTPUT
            echo "environment=canary" >> $GITHUB_OUTPUT
            ENVIRONMENT="canary"
          elif [ "$BRANCH" = "main" ]; then
            echo "service_id=${{ secrets.RAILWAY_SERVICE_ID_PROD }}" >> $GITHUB_OUTPUT
            echo "environment=production" >> $GITHUB_OUTPUT
            ENVIRONMENT="production"
          else
            echo "⚠️ Unknown branch: $BRANCH, skipping deployment"
            echo "should_deploy=false" >> $GITHUB_OUTPUT
            exit 0
          fi
          
          echo "should_deploy=true" >> $GITHUB_OUTPUT
          echo "✅ Will deploy to $ENVIRONMENT (branch: $BRANCH)"

      - name: Checkout Repo
        if: steps.config.outputs.should_deploy == 'true'
        uses: actions/checkout@v4
        with:
          # For manual trigger: use input branch (already validated as canary/main)
          # For automatic trigger: use branch from validated marker (not workflow_run.head_branch for security)
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.branch || steps.marker-info.outputs.branch }}
          fetch-depth: 0

      - name: Deploy to Railway
        if: steps.config.outputs.should_deploy == 'true'
        env:
          SERVICE_ID: ${{ steps.config.outputs.service_id }}
          ENVIRONMENT: ${{ steps.config.outputs.environment }}
          EVENT_NAME: ${{ github.event_name }}
          INPUT_BRANCH: ${{ github.event.inputs.branch }}
        run: |
          if [ -z "$SERVICE_ID" ]; then
            echo "⚠️ Service ID not configured for $ENVIRONMENT, skipping deployment"
            exit 0
          fi
          
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            echo "🚀 Manually deploying to Railway ($ENVIRONMENT) from latest commit on $INPUT_BRANCH..."
          else
            echo "🚀 Deploying to Railway ($ENVIRONMENT) after package publish..."
          fi
          
          docker run --rm \
            -e RAILWAY_TOKEN="${{ secrets.RAILWAY_TOKEN }}" \
            -v "$PWD:/workspace" \
            -w /workspace \
            ghcr.io/railwayapp/cli:latest \
            railway up --service=$SERVICE_ID
          echo "✅ Successfully deployed to Railway"