create-einja-app 0.2.15 → 0.2.18

package/templates/default/.github/workflows/deploy-pr-preview.yml

@@ -0,0 +1,398 @@
+name: PR Preview
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: pr-preview-${{ github.event.number }}
+  cancel-in-progress: true
+
+jobs:
+  # CI チェック（PostgreSQLサービスコンテナ付き）
+  ci:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:15-alpine
+        env:
+          POSTGRES_DB: test_db
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/ci
+        with:
+          database-url: postgresql://postgres:postgres@localhost:5432/test_db
+
+  # Neon Branch作成 + スキーマ同期 + シード
+  neon-and-schema:
+    needs: ci
+    runs-on: ubuntu-latest
+    outputs:
+      branch_id: ${{ steps.create-branch.outputs.branch_id }}
+      neon_parent: ${{ steps.neon-parent.outputs.parent }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+
+      # 0. .env.previewからNeon環境変数をエクスポート
+      - name: Export Neon environment variables
+        uses: ./.github/actions/neon-export-env
+        with:
+          dotenv-private-key-preview: ${{ secrets.DOTENV_PRIVATE_KEY_PREVIEW }}
+
+      - name: Generate artifacts
+        run: pnpm generate
+
+      # 1. Neon親ブランチの動的選択（フォールバック付き）
+      - name: Determine Neon parent branch
+        id: neon-parent
+        run: |
+          BASE_REF="${{ github.event.pull_request.base.ref }}"
+
+          # Gitブランチ名 → Neonブランチ名のマッピング
+          case "$BASE_REF" in
+            main)    NEON_BRANCH="production" ;;
+            develop) NEON_BRANCH="development" ;;
+            *)       NEON_BRANCH="$BASE_REF" ;;
+          esac
+
+          echo "Git base branch: $BASE_REF → Neon branch: $NEON_BRANCH"
+
+          # Neon APIでブランチの存在を確認
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            "https://console.neon.tech/api/v2/projects/${{ env.NEON_PROJECT_ID }}/branches?search=$NEON_BRANCH" \
+            -H "Authorization: Bearer ${{ env.NEON_API_KEY }}" \
+            -H "Accept: application/json")
+
+          if [ "$HTTP_STATUS" = "200" ]; then
+            # ブランチ一覧から完全一致を確認
+            BRANCH_EXISTS=$(curl -s \
+              "https://console.neon.tech/api/v2/projects/${{ env.NEON_PROJECT_ID }}/branches?search=$NEON_BRANCH" \
+              -H "Authorization: Bearer ${{ env.NEON_API_KEY }}" \
+              -H "Accept: application/json" | jq -r ".branches[] | select(.name == \"$NEON_BRANCH\") | .name")
+
+            if [ -n "$BRANCH_EXISTS" ]; then
+              echo "parent=$NEON_BRANCH" >> $GITHUB_OUTPUT
+              echo "Neon parent branch: $NEON_BRANCH"
+            else
+              echo "parent=production" >> $GITHUB_OUTPUT
+              echo "Neon parent branch: production (fallback - '$NEON_BRANCH' not found in Neon)"
+            fi
+          else
+            echo "parent=production" >> $GITHUB_OUTPUT
+            echo "Neon parent branch: production (fallback - API returned $HTTP_STATUS)"
+          fi
+
+      # 2. Neon Branch 作成（v6 + expires_at）
+      - name: Create Neon Branch
+        id: create-branch
+        uses: neondatabase/create-branch-action@v6
+        with:
+          project_id: ${{ env.NEON_PROJECT_ID }}
+          branch_name: preview/pr-${{ github.event.number }}
+          api_key: ${{ env.NEON_API_KEY }}
+          parent_branch: ${{ steps.neon-parent.outputs.parent }}
+          # 1日間アクセスがなければサスペンド（コスト削減）
+          suspend_timeout: 86400
+
+      # 2.5. DB URLの解決（connection_uri API方式）
+      - name: Resolve DB URLs
+        id: resolve-db
+        run: |
+          DB_URL="${{ steps.create-branch.outputs.db_url }}"
+          DB_URL_POOLED="${{ steps.create-branch.outputs.db_url_pooled }}"
+
+          if [ -z "$DB_URL" ] || [ -z "$DB_URL_POOLED" ]; then
+            echo "::notice::Branch was reused — fetching DB URLs from Neon API..."
+            BRANCH_ID="${{ steps.create-branch.outputs.branch_id }}"
+
+            # connection_uri APIで直接URL取得（sed不要）
+            DB_URL=$(curl -s \
+              "https://console.neon.tech/api/v2/projects/${{ env.NEON_PROJECT_ID }}/connection_uri?branch_id=$BRANCH_ID&pooled=false&database_name=neondb" \
+              -H "Authorization: Bearer ${{ env.NEON_API_KEY }}" \
+              -H "Accept: application/json" | jq -r '.uri')
+
+            DB_URL_POOLED=$(curl -s \
+              "https://console.neon.tech/api/v2/projects/${{ env.NEON_PROJECT_ID }}/connection_uri?branch_id=$BRANCH_ID&pooled=true&database_name=neondb" \
+              -H "Authorization: Bearer ${{ env.NEON_API_KEY }}" \
+              -H "Accept: application/json" | jq -r '.uri')
+
+            if [ -z "$DB_URL" ] || [ "$DB_URL" = "null" ] || [ -z "$DB_URL_POOLED" ] || [ "$DB_URL_POOLED" = "null" ]; then
+              echo "::error::Failed to resolve DB URLs from Neon API"
+              exit 1
+            fi
+          fi
+
+          # ログへの漏洩を防止
+          echo "::add-mask::$DB_URL"
+          echo "::add-mask::$DB_URL_POOLED"
+
+          # heredoc形式でGITHUB_OUTPUTに書き込み（特殊文字対応）
+          {
+            echo "db_url<<NEON_EOF"
+            echo "$DB_URL"
+            echo "NEON_EOF"
+            echo "db_url_pooled<<NEON_EOF"
+            echo "$DB_URL_POOLED"
+            echo "NEON_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      # 3. スキーマ同期 + シード（直接接続）
+      - name: Push Schema
+        run: pnpm db:push -- --accept-data-loss
+        env:
+          DATABASE_URL: ${{ steps.resolve-db.outputs.db_url }}
+
+      - name: Run Seed
+        run: pnpm --filter @repo/server-core db:seed
+        env:
+          DATABASE_URL: ${{ steps.resolve-db.outputs.db_url }}
+
+  # Web/Adminデプロイ（並列実行）
+  deploy:
+    needs: neon-and-schema
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        app: [web, admin]
+    env:
+      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
+      VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+
+      # Neon環境変数のエクスポート（DB URL取得に必要）
+      - name: Export Neon environment variables
+        uses: ./.github/actions/neon-export-env
+        with:
+          dotenv-private-key-preview: ${{ secrets.DOTENV_PRIVATE_KEY_PREVIEW }}
+
+      # Neon APIからDB URLを取得（connection_uri API方式）
+      - name: Fetch DB URLs from Neon API
+        id: db-urls
+        run: |
+          BRANCH_ID="${{ needs.neon-and-schema.outputs.branch_id }}"
+
+          # connection_uri APIで直接URL取得
+          DB_URL=$(curl -s \
+            "https://console.neon.tech/api/v2/projects/${{ env.NEON_PROJECT_ID }}/connection_uri?branch_id=$BRANCH_ID&pooled=false&database_name=neondb" \
+            -H "Authorization: Bearer ${{ env.NEON_API_KEY }}" \
+            -H "Accept: application/json" | jq -r '.uri')
+
+          DB_URL_POOLED=$(curl -s \
+            "https://console.neon.tech/api/v2/projects/${{ env.NEON_PROJECT_ID }}/connection_uri?branch_id=$BRANCH_ID&pooled=true&database_name=neondb" \
+            -H "Authorization: Bearer ${{ env.NEON_API_KEY }}" \
+            -H "Accept: application/json" | jq -r '.uri')
+
+          if [ -z "$DB_URL" ] || [ "$DB_URL" = "null" ] || [ -z "$DB_URL_POOLED" ] || [ "$DB_URL_POOLED" = "null" ]; then
+            echo "::error::Failed to resolve DB URLs from Neon API"
+            exit 1
+          fi
+
+          echo "::add-mask::$DB_URL"
+          echo "::add-mask::$DB_URL_POOLED"
+
+          {
+            echo "db_url<<NEON_EOF"
+            echo "$DB_URL"
+            echo "NEON_EOF"
+            echo "db_url_pooled<<NEON_EOF"
+            echo "$DB_URL_POOLED"
+            echo "NEON_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Validate DATABASE_URL
+        run: |
+          if [ -z "${{ steps.db-urls.outputs.db_url_pooled }}" ]; then
+            echo "::error::DATABASE_URL is empty. Neon API may have failed."
+            exit 1
+          fi
+
+      - name: Resolve Vercel Project ID
+        id: resolve
+        run: |
+          case "${{ matrix.app }}" in
+            web)   echo "project_id=${{ secrets.VERCEL_PROJECT_ID_WEB }}" >> $GITHUB_OUTPUT ;;
+            admin) echo "project_id=${{ secrets.VERCEL_PROJECT_ID_ADMIN }}" >> $GITHUB_OUTPUT ;;
+          esac
+
+      - name: Set VERCEL_PROJECT_ID
+        run: echo "VERCEL_PROJECT_ID=${{ steps.resolve.outputs.project_id }}" >> $GITHUB_ENV
+
+      - name: Install Vercel CLI
+        run: pnpm add -g vercel@latest
+
+      - name: Pull Vercel Environment (apps/${{ matrix.app }})
+        run: vercel pull --yes --environment=preview --token=$VERCEL_TOKEN
+
+      - name: Get Vercel project name
+        id: project-name
+        run: |
+          PROJECT_NAME=$(curl -s \
+            "https://api.vercel.com/v9/projects/${{ steps.resolve.outputs.project_id }}" \
+            -H "Authorization: Bearer $VERCEL_TOKEN" | jq -r '.name')
+          if [ -z "$PROJECT_NAME" ] || [ "$PROJECT_NAME" = "null" ]; then
+            echo "::warning::プロジェクト名の取得に失敗しました。aliasは設定されません。"
+            echo "name=" >> $GITHUB_OUTPUT
+          else
+            # DNS安全のため小文字に正規化
+            PROJECT_NAME=$(echo "$PROJECT_NAME" | tr '[:upper:]' '[:lower:]')
+            echo "name=$PROJECT_NAME" >> $GITHUB_OUTPUT
+          fi
+
+      # Vercel環境変数の自動同期（encrypted-only方式：dotenvxで管理しているもの = Vercelに同期すべきもの）
+      - name: Sync environment variables to Vercel
+        run: |
+          # .env.previewから encrypted: を含むキー名を抽出
+          # NEON_*とDATABASE_*を除外（Neon APIから動的取得・--envで注入するため）
+          ENCRYPTED_KEYS=$(grep 'encrypted:' $GITHUB_WORKSPACE/.env.preview | sed 's/=.*//' | grep -vE '^(NEON_|DATABASE_)')
+
+          npx dotenvx run -f $GITHUB_WORKSPACE/.env.preview -- bash -c "
+            for key in $ENCRYPTED_KEYS; do
+              value=\$(printenv \"\$key\" 2>/dev/null || true)
+              if [ -n \"\$value\" ]; then
+                echo \"Syncing \$key to Vercel (preview)...\"
+                echo \"\$value\" | vercel env rm \"\$key\" preview --yes --token=\$VERCEL_TOKEN 2>/dev/null || true
+                echo \"\$value\" | vercel env add \"\$key\" preview --token=\$VERCEL_TOKEN
+              fi
+            done
+          "
+        env:
+          DOTENV_PRIVATE_KEY_PREVIEW: ${{ secrets.DOTENV_PRIVATE_KEY_PREVIEW }}
+
+      # NOTE: dotenvxはデフォルトで既存の環境変数を上書きしない
+      # env:で設定したDATABASE_URLがNeonブランチのURLとして優先される
+      - name: Build Project (apps/${{ matrix.app }})
+        run: |
+          npx dotenvx run -f $GITHUB_WORKSPACE/.env.preview -- \
+            vercel build --token=$VERCEL_TOKEN
+        env:
+          DOTENV_PRIVATE_KEY_PREVIEW: ${{ secrets.DOTENV_PRIVATE_KEY_PREVIEW }}
+          DATABASE_URL: ${{ steps.db-urls.outputs.db_url_pooled }}
+
+      # Vercel Deploy（ランタイムにもDATABASE_URLを渡す）
+      - name: Deploy to Vercel
+        id: deploy
+        run: |
+          DEPLOY_URL=$(vercel deploy --prebuilt --token=$VERCEL_TOKEN \
+            --env DATABASE_URL="${{ steps.db-urls.outputs.db_url_pooled }}")
+          echo "url=$DEPLOY_URL" >> $GITHUB_OUTPUT
+
+      - name: Set Vercel alias
+        if: steps.project-name.outputs.name != ''
+        id: set-alias
+        continue-on-error: true
+        run: |
+          ALIAS="${{ steps.project-name.outputs.name }}-pr-${{ github.event.number }}.vercel.app"
+          vercel alias ${{ steps.deploy.outputs.url }} "$ALIAS" --token=$VERCEL_TOKEN
+          echo "url=https://$ALIAS" >> $GITHUB_OUTPUT
+
+      # デプロイURLをartifactとして保存
+      - name: Save deploy URL
+        run: |
+          ALIAS_URL="${{ steps.set-alias.outputs.url }}"
+          DEPLOY_URL="${{ steps.deploy.outputs.url }}"
+          if [ -n "$ALIAS_URL" ]; then
+            echo "$ALIAS_URL" > deploy-url-${{ matrix.app }}.txt
+          else
+            echo "::warning::Alias未設定のためランダムURLを使用: $DEPLOY_URL"
+            echo "$DEPLOY_URL" > deploy-url-${{ matrix.app }}.txt
+          fi
+
+      - name: Upload deploy URL
+        uses: actions/upload-artifact@v4
+        with:
+          name: deploy-url-${{ matrix.app }}
+          path: deploy-url-${{ matrix.app }}.txt
+          retention-days: 1
+
+  # PRコメント
+  comment:
+    needs: [neon-and-schema, deploy]
+    if: always() && needs.neon-and-schema.result == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download deploy URLs
+        uses: actions/download-artifact@v4
+        with:
+          pattern: deploy-url-*
+          merge-multiple: true
+        continue-on-error: true
+
+      - name: Read deploy URLs
+        id: urls
+        run: |
+          if [ -f deploy-url-web.txt ]; then
+            echo "web=$(cat deploy-url-web.txt)" >> $GITHUB_OUTPUT
+          else
+            echo "web=Deploy failed" >> $GITHUB_OUTPUT
+          fi
+          if [ -f deploy-url-admin.txt ]; then
+            echo "admin=$(cat deploy-url-admin.txt)" >> $GITHUB_OUTPUT
+          else
+            echo "admin=Deploy failed" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Comment on PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const marker = '<!-- neon-preview-url -->';
+            const body = `${marker}
+            ## 🚀 Preview Deployment
+
+            | Item | Value |
+            |------|-------|
+            | **Web Preview URL** | ${{ steps.urls.outputs.web }} |
+            | **Admin Preview URL** | ${{ steps.urls.outputs.admin }} |
+            | **Neon Branch** | \`preview/pr-${{ github.event.number }}\` |
+            | **Neon Parent** | \`${{ needs.neon-and-schema.outputs.neon_parent }}\` |
+            | **Commit** | ${{ github.event.pull_request.head.sha }} |
+            `;
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+
+            const existing = comments.find(c =>
+              c.user.type === 'Bot' && c.body.includes(marker)
+            );
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }

package/templates/default/.github/workflows/deploy-stable-branches.yml

@@ -0,0 +1,259 @@
+name: Deploy Stable Branches
+
+on:
+  push:
+    branches: [main, develop, staging]
+
+concurrency:
+  group: deploy-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:15-alpine
+        env:
+          POSTGRES_DB: test_db
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run CI checks
+        uses: ./.github/actions/ci
+        with:
+          database-url: postgresql://postgres:postgres@localhost:5432/test_db
+
+  # 変更検知
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      web: ${{ steps.filter.outputs.web }}
+      admin: ${{ steps.filter.outputs.admin }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            web:
+              - 'apps/web/**'
+              - 'packages/ui/**'
+              - 'packages/front-core/**'
+              - 'packages/server-core/**'
+              - 'packages/config/**'
+              - 'package.json'
+              - 'pnpm-lock.yaml'
+              - 'turbo.json'
+              - 'tsconfig.json'
+              - '.env.*'
+            admin:
+              - 'apps/admin/**'
+              - 'packages/admin-ui/**'
+              - 'packages/front-core/**'
+              - 'packages/server-core/**'
+              - 'packages/config/**'
+              - 'package.json'
+              - 'pnpm-lock.yaml'
+              - 'turbo.json'
+              - 'tsconfig.json'
+              - '.env.*'
+
+  migrate:
+    needs: ci
+    if: github.ref_name == 'main' || github.ref_name == 'staging'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # main: production環境マイグレーション（シード無効）
+      - name: Migrate production
+        if: github.ref_name == 'main'
+        uses: ./.github/actions/migrate
+        with:
+          dotenv-file: ${{ github.workspace }}/.env.production
+          dotenv-private-key: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}
+          run-seed: 'false'
+
+      # staging: ステージング環境マイグレーション（シード無効）
+      - name: Migrate staging
+        if: github.ref_name == 'staging'
+        uses: ./.github/actions/migrate
+        with:
+          dotenv-file: ${{ github.workspace }}/.env.staging
+          dotenv-private-key: ${{ secrets.DOTENV_PRIVATE_KEY_STAGING }}
+          run-seed: 'false'
+
+  # Web/Adminデプロイ（並列実行・変更検知付き）
+  deploy:
+    needs: [ci, migrate, changes]
+    if: always() && needs.ci.result == 'success' && needs.changes.result == 'success' && (needs.migrate.result == 'success' || needs.migrate.result == 'skipped')
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        app: [web, admin]
+    env:
+      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
+      VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+    steps:
+      # 変更検知によるスキップ判定
+      - name: Check if deploy is needed
+        id: check
+        run: |
+          case "${{ matrix.app }}" in
+            web)   CHANGED="${{ needs.changes.outputs.web }}" ;;
+            admin) CHANGED="${{ needs.changes.outputs.admin }}" ;;
+          esac
+          if [ "$CHANGED" = "true" ]; then
+            echo "should_deploy=true" >> $GITHUB_OUTPUT
+            echo "${{ matrix.app }}: changes detected, will deploy"
+          else
+            echo "should_deploy=false" >> $GITHUB_OUTPUT
+            echo "${{ matrix.app }}: no changes detected, skipping deploy"
+          fi
+
+      - uses: actions/checkout@v4
+        if: steps.check.outputs.should_deploy == 'true'
+
+      - name: Setup Environment
+        if: steps.check.outputs.should_deploy == 'true'
+        uses: ./.github/actions/setup
+
+      - name: Resolve Vercel Project ID
+        if: steps.check.outputs.should_deploy == 'true'
+        id: resolve
+        run: |
+          case "${{ matrix.app }}" in
+            web)   echo "project_id=${{ secrets.VERCEL_PROJECT_ID_WEB }}" >> $GITHUB_OUTPUT ;;
+            admin) echo "project_id=${{ secrets.VERCEL_PROJECT_ID_ADMIN }}" >> $GITHUB_OUTPUT ;;
+          esac
+
+      - name: Set VERCEL_PROJECT_ID
+        if: steps.check.outputs.should_deploy == 'true'
+        run: echo "VERCEL_PROJECT_ID=${{ steps.resolve.outputs.project_id }}" >> $GITHUB_ENV
+
+      - name: Install Vercel CLI
+        if: steps.check.outputs.should_deploy == 'true'
+        run: pnpm add -g vercel@latest
+
+      # ブランチ判定 — 環境変数を $GITHUB_ENV に書き出す
+      - name: Determine environment
+        if: steps.check.outputs.should_deploy == 'true'
+        run: |
+          BRANCH="${GITHUB_REF##*/}"
+          case "$BRANCH" in
+            main)
+              echo "DEPLOY_DOTENV_FILE=$GITHUB_WORKSPACE/.env.production" >> $GITHUB_ENV
+              echo "DEPLOY_VERCEL_ENV=production" >> $GITHUB_ENV
+              echo "DEPLOY_PROD_FLAG=--prod" >> $GITHUB_ENV
+              echo "DEPLOY_RUN_ALIAS=false" >> $GITHUB_ENV
+              ;;
+            develop)
+              echo "DEPLOY_DOTENV_FILE=$GITHUB_WORKSPACE/.env.develop" >> $GITHUB_ENV
+              echo "DEPLOY_VERCEL_ENV=preview" >> $GITHUB_ENV
+              echo "DEPLOY_PROD_FLAG=" >> $GITHUB_ENV
+              echo "DEPLOY_RUN_ALIAS=true" >> $GITHUB_ENV
+              ;;
+            staging)
+              echo "DEPLOY_DOTENV_FILE=$GITHUB_WORKSPACE/.env.staging" >> $GITHUB_ENV
+              echo "DEPLOY_VERCEL_ENV=preview" >> $GITHUB_ENV
+              echo "DEPLOY_PROD_FLAG=" >> $GITHUB_ENV
+              echo "DEPLOY_RUN_ALIAS=true" >> $GITHUB_ENV
+              ;;
+          esac
+          echo "Branch: $BRANCH, Environment: $(cat $GITHUB_ENV | grep DEPLOY_VERCEL_ENV)"
+
+      # Extract alias domain（自アプリ分のみ）
+      - name: Extract alias domain
+        if: steps.check.outputs.should_deploy == 'true' && env.DEPLOY_RUN_ALIAS == 'true'
+        run: |
+          case "${{ matrix.app }}" in
+            web)
+              npx dotenvx run -f ${{ env.DEPLOY_DOTENV_FILE }} -- bash -c '
+                echo "VERCEL_ALIAS_DOMAIN=$VERCEL_ALIAS_DOMAIN_WEB" >> "$GITHUB_ENV"
+              '
+              ;;
+            admin)
+              npx dotenvx run -f ${{ env.DEPLOY_DOTENV_FILE }} -- bash -c '
+                echo "VERCEL_ALIAS_DOMAIN=$VERCEL_ALIAS_DOMAIN_ADMIN" >> "$GITHUB_ENV"
+              '
+              ;;
+          esac
+        env:
+          DOTENV_PRIVATE_KEY_STAGING: ${{ secrets.DOTENV_PRIVATE_KEY_STAGING }}
+          DOTENV_PRIVATE_KEY_DEVELOP: ${{ secrets.DOTENV_PRIVATE_KEY_DEVELOP }}
+
+      # Vercel pull
+      - name: Pull Vercel Environment
+        if: steps.check.outputs.should_deploy == 'true'
+        run: vercel pull --yes --environment=${{ env.DEPLOY_VERCEL_ENV }} --token=$VERCEL_TOKEN
+
+      # Vercel環境変数の自動同期（encrypted-only方式：dotenvxで管理しているもの = Vercelに同期すべきもの）
+      - name: Sync environment variables to Vercel
+        if: steps.check.outputs.should_deploy == 'true'
+        run: |
+          # dotenvxファイルから encrypted: を含むキー名を抽出
+          ENCRYPTED_KEYS=$(grep 'encrypted:' ${{ env.DEPLOY_DOTENV_FILE }} | sed 's/=.*//')
+
+          npx dotenvx run -f ${{ env.DEPLOY_DOTENV_FILE }} -- bash -c "
+            for key in $ENCRYPTED_KEYS; do
+              value=\$(printenv \"\$key\" 2>/dev/null || true)
+              if [ -n \"\$value\" ]; then
+                echo \"Syncing \$key to Vercel (${{ env.DEPLOY_VERCEL_ENV }})...\"
+                echo \"\$value\" | vercel env rm \"\$key\" ${{ env.DEPLOY_VERCEL_ENV }} --yes --token=\$VERCEL_TOKEN 2>/dev/null || true
+                echo \"\$value\" | vercel env add \"\$key\" ${{ env.DEPLOY_VERCEL_ENV }} --token=\$VERCEL_TOKEN
+              fi
+            done
+          "
+        env:
+          DOTENV_PRIVATE_KEY_PRODUCTION: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}
+          DOTENV_PRIVATE_KEY_STAGING: ${{ secrets.DOTENV_PRIVATE_KEY_STAGING }}
+          DOTENV_PRIVATE_KEY_DEVELOP: ${{ secrets.DOTENV_PRIVATE_KEY_DEVELOP }}
+
+      # Re-pull after sync
+      - name: Re-pull Vercel Environment
+        if: steps.check.outputs.should_deploy == 'true'
+        run: vercel pull --yes --environment=${{ env.DEPLOY_VERCEL_ENV }} --token=$VERCEL_TOKEN
+
+      # Vercel build (dotenvxでアプリ環境変数を注入)
+      - name: Build Project
+        if: steps.check.outputs.should_deploy == 'true'
+        run: |
+          npx dotenvx run -f ${{ env.DEPLOY_DOTENV_FILE }} -- \
+            vercel build ${{ env.DEPLOY_PROD_FLAG }} --token=$VERCEL_TOKEN
+        env:
+          DOTENV_PRIVATE_KEY_PRODUCTION: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}
+          DOTENV_PRIVATE_KEY_STAGING: ${{ secrets.DOTENV_PRIVATE_KEY_STAGING }}
+          DOTENV_PRIVATE_KEY_DEVELOP: ${{ secrets.DOTENV_PRIVATE_KEY_DEVELOP }}
+
+      # Vercel deploy
+      - name: Deploy to Vercel
+        if: steps.check.outputs.should_deploy == 'true'
+        id: deploy
+        run: |
+          DEPLOY_URL=$(vercel deploy --prebuilt ${{ env.DEPLOY_PROD_FLAG }} --token=$VERCEL_TOKEN)
+          echo "url=$DEPLOY_URL" >> $GITHUB_OUTPUT
+          echo "Deployed to: $DEPLOY_URL"
+
+      # Alias (develop/stagingのみ)
+      - name: Set Vercel alias
+        if: steps.check.outputs.should_deploy == 'true' && env.DEPLOY_RUN_ALIAS == 'true'
+        run: vercel alias ${{ steps.deploy.outputs.url }} "${{ env.VERCEL_ALIAS_DOMAIN }}" --token=$VERCEL_TOKEN