openartifact.github.io/.github/workflows/pages.yml at main · openartifact/openartifact.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
# SPDX-FileCopyrightText: The OpenArtifact Authors
#
# SPDX-License-Identifier: AGPL-3.0-or-later

# Builds https://openartifact.github.io/: the landing page, the docs of the newest
# release of openartifact/openartifact (/latest/), of main (/dev/, unreleased) and of
# the newest stable tag of each older minor line among the last 5 (/vX.Y/), then
# publishes them to GitHub Pages. A broken /dev/ or older version is reported and left
# out; it never keeps the rest from being published.
name: Pages

on:
  push:
    # `rebuild` receives a trigger commit (force-pushed with a deploy key) from
    # openartifact/openartifact's docs-site-trigger.yml on docs changes and tags.
    branches: [main, rebuild]
  # Fallback poll: a run rebuilds only when docs/ of openartifact/openartifact changed or a
  # release tag appeared (see the check job); no secret is needed for that.
  schedule:
    - cron: "*/15 * * * *"
  workflow_dispatch:

permissions:
  contents: read

# One deployment at a time; a queued run is never cancelled mid-publish.
concurrency:
  group: pages
  cancel-in-progress: false

env:
  BUN_VERSION: "1.4.4"

jobs:
  check:
    name: check for changes
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      changed: ${{ steps.diff.outputs.changed }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - id: diff
        env:
          GH_TOKEN: ${{ github.token }}
          EVENT: ${{ github.event_name }}
        run: |
          # Pushes and manual runs always rebuild; only the poll compares.
          if [ "$EVENT" != "schedule" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          wanted=$(scripts/fingerprint.sh)
          # Pages caches files for 10 minutes: ask for a fresh copy so a deploy that just
          # finished is not mistaken for an old one.
          deployed=$(curl -fsS -H 'Cache-Control: no-cache' "https://openartifact.github.io/source.txt?t=$(date +%s)" || true)
          echo "wanted=$wanted deployed=$deployed"
          if [ "$wanted" = "$deployed" ]; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

  build:
    name: build
    needs: check
    if: needs.check.outputs.changed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check out openartifact/openartifact (docs source, all tags)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: openartifact/openartifact
          path: oa
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: ${{ env.BUN_VERSION }}

      # Taken from the checkout before the build, so a docs commit that lands while
      # the build runs is not recorded as published: the next poll sees it and rebuilds.
      - name: Fingerprint the docs source
        run: scripts/fingerprint.sh oa > "$RUNNER_TEMP/source.txt"

      - run: bun install --frozen-lockfile
      - run: bun test scripts
        env:
          OA_SRC_DIR: oa

      - name: Build landing page and docs
        run: bun run build --oa oa

      # Reports broken links and anchors as warnings; a PR to this repository
      # (ci.yml) is where they fail.
      - name: Check links and anchors
        run: bun scripts/check-links.ts _site --known scripts/known-broken-links.txt --warn '*'

      - name: Record what the site was built from
        run: cp "$RUNNER_TEMP/source.txt" _site/source.txt

      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: _site

  deploy:
    name: deploy
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      pages: write # publish the artifact
      id-token: write # prove the deployment comes from this workflow
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - id: deployment
        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1