feat(ops): sync Telegram commands after deploy

.github/workflows/cd.yml

@@ -75,22 +75,20 @@ jobs:
         with:
           ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: .bun-version
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@v2
         with:
           workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
           service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
 
-      - name: Setup Bun
-        if: ${{ needs.check-secrets.outputs.db_secret_ok == 'true' }}
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version-file: .bun-version
-
-      - name: Install dependencies for migrations
-        if: ${{ needs.check-secrets.outputs.db_secret_ok == 'true' }}
-        run: bun install --frozen-lockfile
-
       - name: Run database migrations
         if: ${{ needs.check-secrets.outputs.db_secret_ok == 'true' }}
         env:
@@ -100,6 +98,31 @@ jobs:
       - name: Setup gcloud
         uses: google-github-actions/setup-gcloud@v2
 
+      - name: Load Telegram bot token for command sync
+        id: telegram-token
+        env:
+          TELEGRAM_BOT_TOKEN_SECRET_ID: ${{ vars.TELEGRAM_BOT_TOKEN_SECRET_ID || 'telegram-bot-token' }}
+        run: |
+          set +e
+          token="$(gcloud secrets versions access latest \
+            --secret "${TELEGRAM_BOT_TOKEN_SECRET_ID}" \
+            --project "${{ secrets.GCP_PROJECT_ID }}" 2>/dev/null)"
+          status=$?
+          set -e
+
+          if [[ $status -ne 0 || -z "$token" ]]; then
+            echo "available=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "::add-mask::$token"
+          {
+            echo "available=true"
+            echo "token<<EOF"
+            echo "$token"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Configure Artifact Registry auth
         run: |
           gcloud auth configure-docker "${GCP_REGION}-docker.pkg.dev" --quiet
@@ -141,6 +164,18 @@ jobs:
             --allow-unauthenticated \
             --quiet
 
+      - name: Sync Telegram commands
+        if: ${{ steps.telegram-token.outputs.available == 'true' }}
+        env:
+          TELEGRAM_BOT_TOKEN: ${{ steps.telegram-token.outputs.token }}
+        run: bun run ops:telegram:commands set
+
+      - name: Telegram command sync skipped
+        if: ${{ steps.telegram-token.outputs.available != 'true' }}
+        run: |
+          echo "Telegram command sync skipped."
+          echo "Grant the CD service account access to the bot token secret or set TELEGRAM_BOT_TOKEN_SECRET_ID."
+
   deploy-skipped:
     name: Deploy skipped (missing config)
     runs-on: ubuntu-latest