name: Deploy to Cloudflare

on:
  push:
    branches: [qas]
    paths:
      - 'apps/api/**'
      - 'docker-compose.yml'
      - 'pnpm-workspace.yaml'
  workflow_dispatch: {}

jobs:
  deploy:
    # Runner lives on the same home machine (ux) that Cloudflare Tunnel
    # already points at — no WireGuard/SSH hop needed like the droplet
    # workflow, the runner IS the target.
    runs-on: [self-hosted, ux]
    steps:
      - uses: actions/checkout@v4

      - name: Rebuild and restart backend
        run: docker compose up -d --build backend