web-push/.github/workflows/docs.yml at main · MMMikeM/web-push · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
name: docs

on:
  # After a stable release publishes: the docs describe what `npm install`
  # gives, so neither main, a prerelease, nor a release that failed deploys.
  workflow_run:
    workflows: [release]
    types: [completed]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: docs
  cancel-in-progress: false

jobs:
  build:
    # For a release, the run's head_branch is its tag.
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event.workflow_run.conclusion == 'success' &&
      !contains(github.event.workflow_run.head_branch, '-'))
    runs-on: ubuntu-latest
    steps:
      # Actions pinned to SHAs, not tags: a tag can be moved to point at malicious code.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # The released commit, not main's tip.
          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
          # The build runs third-party build scripts; keep the token out of .git/config.
          persist-credentials: false
          # Full history, for each page's last-updated date.
          fetch-depth: 0

      # Unpinned on purpose: pnpm/action-setup reads the version from
      # package.json's "packageManager" field.
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"
          cache: pnpm
          cache-dependency-path: docs/pnpm-lock.yaml

      # docs/ is its own pnpm root; its build generates the API reference from
      # ../src before running astro build.
      - run: pnpm --dir docs install --frozen-lockfile
      - run: pnpm --dir docs build

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: docs-dist
          path: docs/dist
          retention-days: 1

  # Only the deploy job holds the Cloudflare token: the build job runs
  # third-party build scripts, and this one installs with scripts off.
  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: cloudflare
      url: https://web-push.thelazyweb.dev
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
          persist-credentials: false

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"
          cache: pnpm
          cache-dependency-path: docs/pnpm-lock.yaml

      - run: pnpm --dir docs install --frozen-lockfile --ignore-scripts

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: docs-dist
          path: docs/dist

      - run: pnpm --dir docs exec wrangler deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      # After the deploy, so the engines crawl what just went live. The site is
      # already up either way, so a failed ping only warns.
      - run: node docs/scripts/indexnow.ts
        continue-on-error: true