cloudhal/.github/workflows/docs-deploy.yml at main · cloudhal-dev/cloudhal · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
name: Docs deploy

# RFC-0037 (#236): a push to main deploys cloudhal.dev (the `cloudhal-dev` Worker, apps/docs).
# It runs when something the site is built from changes:
#   apps/docs/**                          the site, its Worker and its build scripts
#   docs/**                               every page (the repository's docs are the site)
#   packages/core-contracts/schemas/**    /schemas/v1/* (scripts/postbuild.ts)
#   packages/cli/src/cli/help.ts          the generated CLI reference (src/lib/reference.ts)
#   security/**                           /.well-known/cloudhal/keys.json and .sig (RFC-0046 §9)
#   pnpm-lock.yaml                        Astro, Starlight and wrangler versions
# and by hand (Actions › Docs deploy › Run workflow). yanked.json needs no deploy: the Worker
# serves it live from the yank-list branch.
#
# - The `docs-deploy` environment (deployment branches: main only) holds CLOUDFLARE_API_TOKEN as a
#   secret and CLOUDFLARE_ACCOUNT_ID as a variable. Until the secret exists the job skips with a
#   notice, so this file can land before the owner adds it.
# - The token reaches the deploy step only, after the install; the job's GitHub token can only
#   read. Actions are pinned by SHA.

on:
  push:
    branches: [main]
    paths:
      - "apps/docs/**"
      - "docs/**"
      - "packages/core-contracts/schemas/**"
      - "packages/cli/src/cli/help.ts"
      - "security/**"
      - "pnpm-lock.yaml"
      - ".github/workflows/docs-deploy.yml"
  workflow_dispatch:

permissions: {}

# One deploy at a time; a newer push waits rather than cancelling one that is uploading.
concurrency:
  group: docs-deploy
  cancel-in-progress: false

jobs:
  deploy:
    name: Build and deploy cloudhal.dev
    if: github.repository == 'cloudhal-dev/cloudhal'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment:
      name: docs-deploy
      url: https://cloudhal.dev
    permissions:
      contents: read
    steps:
      - name: Is the Cloudflare token configured
        id: token
        env:
          HAS_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN != '' }}
          ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          set -euo pipefail
          if [ "$HAS_TOKEN" = "true" ] && [ -n "$ACCOUNT_ID" ]; then
            echo "ready=true" >> "$GITHUB_OUTPUT"
          else
            echo "::notice::docs-deploy has no CLOUDFLARE_API_TOKEN secret or CLOUDFLARE_ACCOUNT_ID variable yet: nothing deployed"
            echo "Skipped: the docs-deploy environment has no Cloudflare token or account id yet." >> "$GITHUB_STEP_SUMMARY"
            echo "ready=false" >> "$GITHUB_OUTPUT"
          fi
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        if: steps.token.outputs.ready == 'true'
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        if: steps.token.outputs.ready == 'true'
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        if: steps.token.outputs.ready == 'true'
        with:
          node-version: 24
          cache: pnpm
      - name: Install
        if: steps.token.outputs.ready == 'true'
        run: pnpm install --frozen-lockfile
      - name: Build and deploy
        if: steps.token.outputs.ready == 'true'
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
        run: pnpm --filter @cloudhal/docs run deploy
      - name: Summary
        if: always() && steps.token.outputs.ready == 'true'
        env:
          OUTCOME: ${{ job.status }}
          SHA: ${{ github.sha }}
        run: |
          echo "cloudhal.dev deploy of ${SHA:0:12} (${OUTCOME})" >> "$GITHUB_STEP_SUMMARY"