ci: deploy HappyView modules to test on push to main

.github/workflows/deploy.yml

@@ -2,21 +2,41 @@ name: Deploy
 
 on:
   push:
-    # Each branch deploys to the GitHub environment with the same name.
-    branches: [staging, production]
+    branches: [main, staging, production]
 
 permissions:
   contents: read
 
-concurrency:
-  group: deploy-${{ github.ref_name }}
-  cancel-in-progress: false
-
 jobs:
+  # Branch and GitHub environment names differ, so map them explicitly here,
+  # once; the `environment` and `concurrency` keys cannot read workflow `env`.
+  resolve:
+    name: Resolve deploy environment
+    runs-on: ubuntu-latest
+    outputs:
+      environment: ${{ steps.map.outputs.environment }}
+    steps:
+      - id: map
+        env:
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          case "$BRANCH" in
+            main) environment=Test ;;
+            staging) environment=Staging ;;
+            production) environment=Production ;;
+            *) echo "::error::No deploy environment is mapped to branch '$BRANCH'; add it to deploy.yml." >&2; exit 1 ;;
+          esac
+          echo "environment=$environment" >> "$GITHUB_OUTPUT"
+
   deploy:
-    name: Install HappyView modules (${{ github.ref_name }})
+    name: Install HappyView modules (${{ needs.resolve.outputs.environment }})
+    needs: resolve
     runs-on: ubuntu-latest
-    environment: ${{ github.ref_name }}
+    environment: ${{ needs.resolve.outputs.environment }}
+    # Deploys to one environment run one at a time and are never cancelled midway.
+    concurrency:
+      group: deploy-${{ needs.resolve.outputs.environment }}
+      cancel-in-progress: false
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

happyview-modules/README.md

@@ -56,10 +56,18 @@ For bundles that register `app.certified.actor.getProfile`, handle lookups requi
 
 ## Deploys
 
-Pushing to the `staging` or `production` branch runs [`.github/workflows/deploy.yml`](../.github/workflows/deploy.yml), which installs this bundle into that environment's HappyView with `pnpm install:api --override`, so assets that differ from this repository are replaced (the repository is the source of truth). Each branch uses the GitHub environment of the same name (`staging` or `production`), and each environment must define its own values; never reuse the production token for staging:
+Pushing to `main`, `staging` or `production` runs [`.github/workflows/deploy.yml`](../.github/workflows/deploy.yml), which installs this bundle into the matching environment's HappyView with `pnpm install:api --override`, so assets that differ from this repository are replaced (the repository is the source of truth). Branches map to GitHub environments explicitly:
+
+| Branch       | GitHub environment |
+| ------------ | ------------------ |
+| `main`       | `Test`             |
+| `staging`    | `Staging`          |
+| `production` | `Production`       |
+
+Each environment must allow deployments from its branch and define its own values; never reuse a token across environments:
 
 - variable `HAPPYVIEW_BASE_URL`: that environment's HappyView origin
 - secret `HAPPYVIEW_ADMIN_TOKEN`: a scoped admin token for that HappyView, including `script-variables:read`
 - variable `HYPERCERTS_HANDLE_RESOLVER_URL`: needed only if that HappyView does not already have this setting; the token then also needs `script-variables:create`
 
-Deploys to each environment run one at a time and are never cancelled midway; staging and production deploys do not block each other.
+Deploys to each environment run one at a time and are never cancelled midway; deploys to different environments do not block each other.