ci(website): version the site through changesets, deploy to Cloudflare Workers

.changeset/site-initial-version.md

@@ -0,0 +1,9 @@
+---
+"nostream-website": minor
+---
+
+feat(website): version and deploy the marketing site
+
+`website/site` joins the pnpm workspace as `nostream-website`, so the marketing site is versioned and released through the same changesets flow as the relay. The site builds as a static bundle (docs and changelog render from the repository at build time — no SSR) and deploys to Cloudflare Workers with static assets at ema.tnsor.network through CI.
+
+The deploy is a Cloudflare Worker with static assets (`website/site/wrangler.jsonc`), built and shipped by the new `Deploy Website` workflow after a release PR merges to `main`.

.github/workflows/deploy-website.yml

@@ -0,0 +1,66 @@
+name: Deploy Website
+
+# The marketing site deploys after a release lands on main: the changesets
+# release PR bumps nostream-website, merging it is the deploy trigger. Version
+# the site with a changeset, merge the release PR — never deploy from a branch.
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "website/site/**"
+      - "pnpm-lock.yaml"
+      - "package.json"
+      - "README.md"
+      - "CLI.md"
+      - "CONFIGURATION.md"
+      - "CONTRIBUTING.md"
+      - "SECURITY.md"
+      - "CHANGELOG.md"
+      - "deploy/**"
+      - "docs/**"
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-website
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    # workflow_dispatch ignores the push-branch filter; a manual run must not
+    # publish a non-main branch to production.
+    if: github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main'
+    name: Build and deploy to Cloudflare Workers
+    runs-on: ubuntu-latest
+    # Deploy credentials live in this GitHub environment: CLOUDFLARE_API_TOKEN
+    # secret (Workers Scripts scope) and CLOUDFLARE_ACCOUNT_ID variable.
+    environment: website
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v3
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+
+      - name: Install workspace dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build the site
+        working-directory: website/site
+        env:
+          SITE_URL: https://ema.tnsor.network
+        run: pnpm run build
+
+      - name: Deploy to Cloudflare Workers
+        working-directory: website/site
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+        run: pnpm exec wrangler deploy

.github/workflows/release.yml

@@ -6,6 +6,10 @@ on:
 
 jobs:
   build-and-push-image:
+    # Changesets tags each workspace package on publish: relay releases tag
+    # vX.Y.Z, website releases tag nostream-website@X.Y.Z. Only a relay tag
+    # should build the relay container image.
+    if: startsWith(github.event.release.tag_name, 'v')
     name: Build and push container image
     runs-on: ubuntu-latest
     env:

.knip.json

@@ -1,27 +1,46 @@
 {
-  "$schema": "https://unpkg.com/knip@2/schema.json",
-  "entry": [
-    "src/index.ts!",
-    "src/import-events.ts!",
-    "src/cli/index.ts!",
-    "src/scripts/benchmark-queries.ts!",
-    "knexfile.js!"
-  ],
-  "project": [
-    "src/**/*.ts!"
-  ],
-  "ignoreDependencies": [
-    "lzma-native"
-  ],
-  "ignore": [
-    ".nostr/**",
-    "src/utils/relay-probe/**"
-  ],
-  "commitlint": false,
-  "eslint": false,
-  "github-actions": false,
-  "husky": false,
-  "mocha": false,
-  "nyc": false,
-  "semantic-release": false
+    "$schema": "https://unpkg.com/knip@2/schema.json",
+    "workspaces": {
+        ".": {
+            "entry": [
+                "src/index.ts!",
+                "src/import-events.ts!",
+                "src/cli/index.ts!",
+                "src/scripts/benchmark-queries.ts!",
+                "knexfile.js!"
+            ],
+            "project": [
+                "src/**/*.ts!"
+            ],
+            "ignoreDependencies": [
+                "lzma-native"
+            ],
+            "ignore": [
+                ".nostr/**",
+                "src/utils/relay-probe/**"
+            ],
+            "commitlint": false,
+            "eslint": false,
+            "github-actions": false,
+            "husky": false,
+            "mocha": false,
+            "nyc": false,
+            "semantic-release": false
+        },
+        "website/site": {
+            "entry": [
+                "astro.config.mjs",
+                "src/**/*.{astro,ts,mjs}",
+                "scripts/*.mjs"
+            ],
+            "ignoreDependencies": [
+                "@fontsource-variable/inter",
+                "@fontsource/jetbrains-mono",
+                "astro",
+                "sharp",
+                "wrangler"
+            ],
+            "astro": true
+        }
+    }
 }