APIARY/.github/workflows/pages.yml at main · Xore/APIARY · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
name: Branding site

on:
  pull_request:
    paths:
      - "branding/**"
      - ".github/workflows/pages.yml"
  push:
    branches:
      - main
    paths:
      - "branding/**"
      - ".github/workflows/pages.yml"
  workflow_dispatch:

# #3313: workflow level defaults to none; each job declares what it spends.
# The ci-target router dispatches the ci-heartbeat canary with GITHUB_TOKEN,
# and a called reusable workflow can never exceed the caller's envelope --
# under-granting it startup-fails the whole run as "Invalid workflow file",
# so that one grant stays on ci-target and reaches no other job. The deploy
# job keeps its own narrower envelope (pages: write, id-token: write).
permissions: {}

concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  # Executor routing ("homeserver first, GitHub-hosted fallback") via the
  # shared ci-router.yml -- same trust gate and heartbeat liveness proof
  # quality.yml's ci-target job documents. The build's whole runtime is
  # checkout files plus a stdlib python script and an artifact upload, so
  # it is executor-agnostic and simply picks runs-on off the router
  # output; on fallback days it reports under the "(GitHub-hosted)"
  # suffixed name per quality.yml's pair-naming rule.
  ci-target:
    name: Pick CI executor
    uses: ./.github/workflows/ci-router.yml
    permissions:
      contents: read
      actions: write
    with:
      ci_homeserver_prs: ${{ vars.CI_HOMESERVER_PRS || '' }}

  build:
    name: Build Pages artifact${{ needs.ci-target.outputs.homeserver != 'true' && ' (GitHub-hosted)' || '' }}
    needs: [ci-target]
    runs-on: ${{ needs.ci-target.outputs.homeserver == 'true' && fromJSON('["self-hosted", "linux", "x64", "honeypot-ci"]') || fromJSON('["ubuntu-latest"]') }}
    timeout-minutes: ${{ needs.ci-target.outputs.homeserver == 'true' && 15 || 360 }}
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure Pages
        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

      - name: Build branding site
        run: python3 branding/scripts/build_pages_site.py --output _site

      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: _site

  # Stays GitHub-hosted unconditionally: it is a seconds-long API call
  # against the github-pages environment (no compute to relocate), and
  # routing it through the heartbeat would only add a router leg between
  # the artifact upload above and the deploy.
  deploy:
    name: Deploy Pages
    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    needs: build
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    steps:
      - name: Deploy Pages
        id: deployment
        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1