deploy.yml

name: Deploy to GitHub Pages

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      pages-base:
        description: >-
          Astro base path for project-level GitHub Pages (e.g. /purview-dev/).
          Leave empty for a custom domain or organisation Pages site.
        required: false
        type: string
        default: ""
  # Called by upstream-refresh.yml when a catalogue project's repository or
  # packages changed since the deployed build (ADR 0014). That workflow also
  # owns the `purview-site-rebuild` repository dispatch, so a release elsewhere
  # waits for its packages to publish before this runs.
  workflow_call:
    inputs:
      pages-base:
        required: false
        type: string
        default: ""
  schedule:
    # Weekly refresh of release information from GitHub and NuGet (download
    # counts and other figures the nightly upstream check does not compare).
    - cron: "17 4 * * 1"

permissions:
  contents: read
  pages: write
  id-token: write

concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        # actions/checkout v7.0.1
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          # Full history so sitemap `lastmod` can use each source file's real
          # last-commit date (see src/src/lib/discovery/last-modified.ts).
          fetch-depth: 0

      - name: Install Bun
        # oven-sh/setup-bun v2.2.0
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
        with:
          bun-version: 1.4.4

      - name: Install Just
        # taiki-e/install-action v2.87.13
        uses: taiki-e/install-action@3a3daafd3b7f23b8f65d9f5ba2db203fb59b79e2
        with:
          tool: just@1.59.0

      # The repository is a Bun workspace: the lockfile and root `package.json`
      # live here, the Astro site package lives in `src/`, and every `bun run`
      # / `just` recipe delegates to `src/` (see `package.json` scripts).
      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Capture the currently deployed discovery manifest
        # Captured before the new site is deployed so the post-deploy IndexNow
        # step can diff "what changed". Published as /_discovery/previous.json
        # (public, non-sensitive) so no cross-job artifact is needed.
        env:
          SITE_URL: ${{ vars.SITE_URL }}
        run: |
          ORIGIN="${SITE_URL:-https://purview.dev}"
          mkdir -p .discovery-capture
          if curl -fsSL "$ORIGIN/discover.json" -o .discovery-capture/previous.json; then
            echo "Captured the previous discovery manifest."
          else
            echo '{"schemaVersion":0,"resources":[]}' > .discovery-capture/previous.json
            echo "No previous discovery manifest (first deployment)."
          fi

      - name: Run validation
        # `just validate` runs a live data sync on fresh checkouts (no cache /
        # docs mirror yet), so pass a token to avoid unauthenticated rate limits.
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: just validate

      - name: Refresh live release and documentation data
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: DATA_MODE=live bun run data:sync

      - name: Resolve deployment base and site URL
        id: pages-config
        env:
          REPO_NAME: ${{ github.event.repository.name }}
          OWNER: ${{ github.repository_owner }}
        run: |
          BASE="${{ vars.PAGES_BASE }}"
          if [ -n "${{ inputs.pages-base }}" ]; then
            BASE="${{ inputs.pages-base }}"
          fi
          if [ -z "$BASE" ]; then
            if [ "$REPO_NAME" = "$OWNER.github.io" ]; then
              BASE="/"
            else
              BASE="/$REPO_NAME"
            fi
          fi
          SITE="${{ vars.SITE_URL }}"
          if [ -z "$SITE" ]; then
            SITE="https://$OWNER.github.io"
          fi
          echo "pages-base=$BASE" >> "$GITHUB_OUTPUT"
          echo "site-url=$SITE" >> "$GITHUB_OUTPUT"

      - name: Build site with live data
        # The build never receives the IndexNow key: the key verification file is
        # written from the secret by a separate step below (see docs/discovery.md).
        env:
          PAGES_BASE: ${{ steps.pages-config.outputs.pages-base }}
          SITE_URL: ${{ steps.pages-config.outputs.site-url }}
        run: bun run build

      - name: Write the IndexNow key verification file
        # The key is supplied only by the INDEXNOW_KEY repository secret and is
        # never part of the build or its logs. This writes /<key>.txt, the file
        # IndexNow fetches to prove ownership of the domain.
        env:
          INDEXNOW_KEY: ${{ secrets.INDEXNOW_KEY }}
        run: |
          if [ -z "${INDEXNOW_KEY}" ]; then
            echo "::warning::INDEXNOW_KEY is not configured; skipping the key verification file."
            exit 0
          fi
          bun run discovery:key

      - name: Validate the discovery artifacts, including the key file
        # The build pipeline cannot require the key verification file (the build
        # never sees the key); this is the one place it is guaranteed to exist.
        # When INDEXNOW_KEY is unset the requirement is a no-op.
        env:
          INDEXNOW_KEY: ${{ secrets.INDEXNOW_KEY }}
        run: bun run discovery:validate --require-indexnow-key

      - name: Publish the previous discovery manifest for change detection
        run: |
          mkdir -p src/dist/_discovery
          cp .discovery-capture/previous.json src/dist/_discovery/previous.json

      - name: Record the upstream state this build was made from
        # Published as /_discovery/upstream.json. The nightly upstream check
        # compares the catalogue repositories and packages with it and skips the
        # rebuild when nothing moved (ADR 0014).
        run: bun run upstream:state --write dist/_discovery/upstream.json

      - name: Configure Pages
        # actions/configure-pages v6.0.0
        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d

      - name: Upload Pages artifact
        # actions/upload-pages-artifact v5.0.0
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9
        with:
          # Build output is written into the `src/` package (see package.json).
          path: ./src/dist

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        # actions/deploy-pages v5.0.1
        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346

  indexnow:
    # Runs only after a successful production deployment. A failed deploy must
    # never tell search engines that new URLs are live. The site deployment
    # stands on its own; a notification failure is reported here, not by
    # rolling the deployment back.
    needs: deploy
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        # actions/checkout v7.0.1
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install Bun
        # oven-sh/setup-bun v2.2.0
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
        with:
          bun-version: 1.4.4

      - name: Notify IndexNow about changed URLs
        # Submits only URLs added or modified since the previous deployment.
        # `discovery:indexnow` has no external dependencies, so no `bun install`
        # is needed. The IndexNow key is never printed.
        env:
          SITE_URL: ${{ vars.SITE_URL }}
          INDEXNOW_KEY: ${{ secrets.INDEXNOW_KEY }}
        run: |
          if [ -z "${INDEXNOW_KEY}" ]; then
            echo "::warning::INDEXNOW_KEY is not configured; skipping the IndexNow notification."
            exit 0
          fi
          ORIGIN="${SITE_URL:-https://purview.dev}"
          bun run discovery:indexnow \
            --current "$ORIGIN/discover.json" \
            --previous "$ORIGIN/_discovery/previous.json"