|
1 | 1 | name: Docs |
2 | 2 |
|
| 3 | +# Deploy the Astro docs site at `docs/` to GitHub Pages. |
| 4 | +# |
| 5 | +# Behaviour: |
| 6 | +# - Push to `main` → build with PPVM_BASE=/ and publish |
| 7 | +# to the gh-pages branch root. |
| 8 | +# - Pull request (opened / → build with PPVM_BASE=/pr-preview/pr-<N> |
| 9 | +# synchronize / reopened) and let rossjrw/pr-preview-action publish |
| 10 | +# the build to gh-pages under |
| 11 | +# `pr-preview/pr-<N>/`. Triggered only when |
| 12 | +# the diff actually touches inputs the |
| 13 | +# site depends on. |
| 14 | +# - Pull request closed → cleanup-preview job removes the |
| 15 | +# `pr-preview/pr-<N>/` subdirectory. |
| 16 | +# |
| 17 | +# The Rust API site under `/rust-api/` is published by `rust-docs.yml` |
| 18 | +# and survives our deploys via `keep_files: true`. |
| 19 | + |
3 | 20 | on: |
4 | 21 | push: |
5 | 22 | branches: [main] |
6 | 23 | pull_request: |
7 | | - types: [opened, synchronize, reopened, closed] |
8 | | - |
| 24 | + types: [opened, synchronize, reopened] |
| 25 | + paths: |
| 26 | + # Site sources, the Rust workspace (consumed by the API JSON |
| 27 | + # extractor), and the Python package (consumed by the notebook |
| 28 | + # build step + the Python API extractor). |
| 29 | + - "docs/**" |
| 30 | + - "crates/**" |
| 31 | + - "ppvm-python/**" |
| 32 | + - ".github/workflows/docs.yml" |
| 33 | + pull_request_target: |
| 34 | + types: [closed] |
| 35 | + |
| 36 | +# No workflow-wide write privileges. Each job declares the narrowest |
| 37 | +# token scope it actually needs. The `build` job executes user-controlled |
| 38 | +# notebooks via `npm run extract:notebooks`, so its token must not be |
| 39 | +# able to push to `gh-pages` (or anything else). Deploys run on |
| 40 | +# separately-scoped jobs that don't see the notebook execution context. |
9 | 41 | permissions: |
10 | | - contents: write |
11 | | - pull-requests: write |
| 42 | + contents: read |
12 | 43 |
|
13 | | -env: |
14 | | - RUSTFLAGS: "-C target-feature=+aes,+sse2" |
| 44 | +concurrency: |
| 45 | + # Serialise per-PR (and main); a fresh build cancels any in-flight one |
| 46 | + # for the same ref so PR comments don't pile up on rapid pushes. |
| 47 | + group: docs-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} |
| 48 | + cancel-in-progress: true |
15 | 49 |
|
16 | 50 | jobs: |
17 | | - deploy-preview: |
18 | | - name: Deploy preview |
19 | | - if: github.event_name == 'pull_request' && github.event.action != 'closed' |
| 51 | + build: |
| 52 | + # Build the static site once, upload it as an artifact, and let the |
| 53 | + # downstream jobs decide where (if anywhere) to publish it. |
| 54 | + if: github.event.action != 'closed' |
| 55 | + name: Build Astro site |
20 | 56 | runs-on: ubuntu-latest |
| 57 | + # Notebook execution runs arbitrary repo-controlled Python here; |
| 58 | + # the token in this job stays read-only so a malicious PR can't |
| 59 | + # exfiltrate it into a gh-pages write. |
| 60 | + permissions: |
| 61 | + contents: read |
| 62 | + outputs: |
| 63 | + base: ${{ steps.compute-base.outputs.base }} |
21 | 64 | steps: |
22 | 65 | - uses: actions/checkout@v4 |
23 | 66 |
|
24 | | - - uses: dtolnay/rust-toolchain@stable |
| 67 | + # Build inputs: nightly Rust for the rustdoc-JSON extractor, |
| 68 | + # uv to run griffe for the Python extractor, Node 20 for Astro. |
| 69 | + - uses: dtolnay/rust-toolchain@nightly |
25 | 70 |
|
26 | 71 | - uses: Swatinem/rust-cache@v2 |
27 | 72 |
|
28 | 73 | - uses: astral-sh/setup-uv@v5 |
29 | 74 |
|
30 | | - - name: Build docs |
31 | | - run: uv run --project ppvm-python --group doc mkdocs build --config-file ppvm-python/mkdocs.yml |
32 | | - |
33 | | - - name: Deploy PR preview |
34 | | - uses: rossjrw/pr-preview-action@v1 |
| 75 | + - uses: actions/setup-node@v4 |
35 | 76 | with: |
36 | | - source-dir: ppvm-python/site/ |
37 | | - |
38 | | - cleanup-preview: |
39 | | - name: Clean up preview |
40 | | - if: github.event_name == 'pull_request' && github.event.action == 'closed' |
| 77 | + node-version: "20" |
| 78 | + cache: "npm" |
| 79 | + cache-dependency-path: docs/package-lock.json |
| 80 | + |
| 81 | + - name: Install Astro deps |
| 82 | + # `npm ci` is faster than `npm install` and asserts the |
| 83 | + # lockfile is in sync; it fails loudly if package.json and |
| 84 | + # package-lock.json have drifted. |
| 85 | + run: npm ci |
| 86 | + working-directory: docs |
| 87 | + |
| 88 | + - name: Compute base path |
| 89 | + id: compute-base |
| 90 | + run: | |
| 91 | + if [[ "${{ github.event_name }}" == "pull_request" ]]; then |
| 92 | + echo "base=/pr-preview/pr-${{ github.event.pull_request.number }}" >> "$GITHUB_OUTPUT" |
| 93 | + else |
| 94 | + echo "base=/" >> "$GITHUB_OUTPUT" |
| 95 | + fi |
| 96 | +
|
| 97 | + - name: Compute git ref for source links |
| 98 | + id: compute-ref |
| 99 | + # "Source" links on the Examples pages resolve against this ref. |
| 100 | + # PR previews use the PR head SHA so new files (that aren't on |
| 101 | + # main yet) still link correctly; main deploys use the merge |
| 102 | + # commit SHA so the link is stable forever. |
| 103 | + run: | |
| 104 | + if [[ "${{ github.event_name }}" == "pull_request" ]]; then |
| 105 | + echo "ref=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT" |
| 106 | + else |
| 107 | + echo "ref=${{ github.sha }}" >> "$GITHUB_OUTPUT" |
| 108 | + fi |
| 109 | +
|
| 110 | + - name: Build site |
| 111 | + # `npm run build` aggregates the three extraction steps |
| 112 | + # (`extract:rust`, `extract:python`, `extract:notebooks`) plus |
| 113 | + # `astro build` into a single command. See `docs/README.md` |
| 114 | + # for the per-step breakdown and the per-component escape |
| 115 | + # hatches a developer would use locally. |
| 116 | + working-directory: docs |
| 117 | + env: |
| 118 | + PPVM_SITE: https://congenial-bassoon-l436wp3.pages.github.io |
| 119 | + PPVM_BASE: ${{ steps.compute-base.outputs.base }} |
| 120 | + PPVM_GIT_REF: ${{ steps.compute-ref.outputs.ref }} |
| 121 | + RUSTFLAGS: "-C target-feature=+aes,+sse2" |
| 122 | + run: npm run build |
| 123 | + |
| 124 | + - name: Upload built site |
| 125 | + uses: actions/upload-artifact@v4 |
| 126 | + with: |
| 127 | + name: docs-dist |
| 128 | + path: docs/dist/ |
| 129 | + if-no-files-found: error |
| 130 | + retention-days: 7 |
| 131 | + |
| 132 | + deploy-main: |
| 133 | + name: Deploy to gh-pages |
| 134 | + needs: build |
| 135 | + if: github.event_name == 'push' && github.ref == 'refs/heads/main' |
41 | 136 | runs-on: ubuntu-latest |
| 137 | + # Only this job writes to gh-pages; it doesn't run any |
| 138 | + # repo-controlled scripts (the artifact is already built). |
| 139 | + permissions: |
| 140 | + contents: write |
| 141 | + concurrency: |
| 142 | + group: deploy-gh-pages |
| 143 | + cancel-in-progress: false |
42 | 144 | steps: |
43 | 145 | - uses: actions/checkout@v4 |
44 | 146 |
|
45 | | - - uses: rossjrw/pr-preview-action@v1 |
| 147 | + - uses: actions/download-artifact@v4 |
46 | 148 | with: |
47 | | - source-dir: ppvm-python/site/ |
| 149 | + name: docs-dist |
| 150 | + path: docs/dist/ |
48 | 151 |
|
49 | | - deploy-dev: |
50 | | - name: Deploy dev docs |
51 | | - if: github.ref == 'refs/heads/main' |
| 152 | + - name: Publish to gh-pages root |
| 153 | + uses: peaceiris/actions-gh-pages@v3 |
| 154 | + with: |
| 155 | + github_token: ${{ secrets.GITHUB_TOKEN }} |
| 156 | + publish_dir: ./docs/dist |
| 157 | + # Preserve /rust-api/ (managed by rust-docs.yml) and |
| 158 | + # /pr-preview/* (managed by pr-preview-action below). |
| 159 | + keep_files: true |
| 160 | + commit_message: "docs: deploy ${{ github.sha }}" |
| 161 | + |
| 162 | + deploy-preview: |
| 163 | + name: Deploy PR preview |
| 164 | + needs: build |
| 165 | + if: github.event_name == 'pull_request' && github.event.action != 'closed' |
52 | 166 | runs-on: ubuntu-latest |
| 167 | + # Writes the pre-built artifact to gh-pages/pr-preview/pr-<N>/ |
| 168 | + # and comments back on the PR. |
| 169 | + permissions: |
| 170 | + contents: write |
| 171 | + pull-requests: write |
53 | 172 | concurrency: |
54 | | - group: deploy-dev |
| 173 | + group: deploy-gh-pages |
55 | 174 | cancel-in-progress: false |
56 | 175 | steps: |
57 | 176 | - uses: actions/checkout@v4 |
58 | | - with: |
59 | | - fetch-depth: 0 # mike needs full history to push to gh-pages |
60 | | - |
61 | | - - uses: dtolnay/rust-toolchain@stable |
62 | 177 |
|
63 | | - - uses: Swatinem/rust-cache@v2 |
64 | | - |
65 | | - - uses: astral-sh/setup-uv@v5 |
| 178 | + - uses: actions/download-artifact@v4 |
| 179 | + with: |
| 180 | + name: docs-dist |
| 181 | + path: docs/dist/ |
66 | 182 |
|
67 | | - - name: Configure git |
68 | | - run: | |
69 | | - git config user.name "github-actions[bot]" |
70 | | - git config user.email "github-actions[bot]@users.noreply.github.com" |
| 183 | + - name: Deploy PR preview to gh-pages/pr-preview/pr-<N> |
| 184 | + uses: rossjrw/pr-preview-action@v1 |
| 185 | + with: |
| 186 | + source-dir: docs/dist/ |
| 187 | + preview-branch: gh-pages |
| 188 | + umbrella-dir: pr-preview |
71 | 189 |
|
72 | | - - name: Fetch gh-pages branch |
73 | | - run: git fetch origin gh-pages --depth=1 || true |
| 190 | + cleanup-preview: |
| 191 | + name: Clean up PR preview |
| 192 | + if: github.event_name == 'pull_request_target' && github.event.action == 'closed' |
| 193 | + runs-on: ubuntu-latest |
| 194 | + # Removes the gh-pages/pr-preview/pr-<N>/ subtree and edits the |
| 195 | + # PR's preview comment; nothing else. |
| 196 | + permissions: |
| 197 | + contents: write |
| 198 | + pull-requests: write |
| 199 | + concurrency: |
| 200 | + group: deploy-gh-pages |
| 201 | + cancel-in-progress: false |
| 202 | + steps: |
| 203 | + - uses: actions/checkout@v4 |
74 | 204 |
|
75 | | - - name: Deploy dev docs with mike |
76 | | - run: uv run --project ppvm-python --group doc mike deploy dev --push --config-file ppvm-python/mkdocs.yml |
| 205 | + - uses: rossjrw/pr-preview-action@v1 |
| 206 | + with: |
| 207 | + source-dir: docs/dist/ |
| 208 | + preview-branch: gh-pages |
| 209 | + umbrella-dir: pr-preview |
| 210 | + action: remove |
0 commit comments