deploy.yml

name: Build and deploy site

on:
  push:
    branches: [main]
  # Rebuild daily so the validation-page badges pick up new test counts and
  # coverage. Runs after the coverage-badge refresh so the figures are current.
  schedule:
    - cron: '37 6 * * *'
  workflow_dispatch:

permissions:
  contents: read
  pages: write
  id-token: write

concurrency:
  group: pages
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    # The build puts a token in the environment of the whole npm build, where any
    # build-time dependency can read it, so this job holds only the scope the
    # checkout needs. The deploy scopes stay with the deploy job.
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      # The badge generator reads each module's CI status from the GitHub Actions
      # API. That data is public and needs no permission; the token is only for
      # the rate limit. Unauthenticated calls draw on 60 per hour tied to the
      # runner's outbound IP, which is shared with other Actions traffic and is
      # sometimes spent before this build starts, leaving the CI badges at "n/a".
      #
      # The generator runs as the prebuild hook in package.json, so the token
      # belongs on the build step: giving the generator a step of its own would
      # leave prebuild running it a second time, unauthenticated, every build.
      - run: npm run build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/upload-pages-artifact@v5
        with:
          path: ./dist

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - id: deployment
        uses: actions/deploy-pages@v5