.github/workflows/deploy.yml (2629B)
1 name: Deploy to GitHub Pages
2
3 on:
4 push:
5 branches: [main]
6 workflow_dispatch:
7
8 # Nothing granted at workflow level; each job names what it needs. The build job runs
9 # every npm dependency, mermaid and Chrome, so it can read the repository and nothing
10 # more. Only the deploy job, which runs one pinned action, can write to Pages or mint an
11 # OIDC token.
12 permissions: {}
13
14 # Serialise deploys without cancelling one that is already running.
15 concurrency:
16 group: pages
17 cancel-in-progress: false
18
19 # Actions are pinned to commit SHAs rather than tags: a tag can be moved to other code with
20 # no change in this repository, a SHA cannot. The comment after each pin names the release.
21 # Dependabot proposes the bumps (.github/dependabot.yml).
22 jobs:
23 build:
24 runs-on: ubuntu-latest
25 permissions:
26 contents: read
27 steps:
28 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
29 with:
30 # Nothing in this job pushes, so the token is not left behind in .git/config.
31 persist-credentials: false
32 # withastro/action installs with `npm install`, which quietly resolves new versions
33 # when package.json and package-lock.json disagree. `npm ci` refuses instead; as a
34 # dry run it does so without installing anything or running any package's scripts.
35 - run: npm ci --dry-run --ignore-scripts
36 - uses: withastro/action@3eafd002e65cc31b4f0eae0bb05450d521562247 # v6.1.3
37 with:
38 node-version: 24
39 # Must go through npm run build so that prebuild — the content gate — runs.
40 # Calling astro build directly would skip it.
41 build-cmd: npm run build
42 # The action caches node_modules/.astro by default, and that store holds each
43 # post's rendered HTML keyed only by the .md file's digest. Restored, it ships the
44 # old HTML after a change to a Markdown plugin, a diagram or an image, and it keeps
45 # a failed render failed without logging it again. A cold content build costs
46 # under a second.
47 cache: false
48 env:
49 # Raise to `all` once decks and tags are backfilled, and do not lower it again.
50 CONTENT_STRICT: urls,schema
51
52 deploy:
53 needs: build
54 runs-on: ubuntu-latest
55 # The minimum actions/deploy-pages documents for the job that deploys.
56 permissions:
57 pages: write
58 id-token: write
59 environment:
60 name: github-pages
61 url: ${{ steps.deployment.outputs.page_url }}
62 steps:
63 - id: deployment
64 uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1