.github/workflows/deploy.yml (3884B)
1 name: CI and deploy
2
3 on:
4 pull_request:
5 branches: [main]
6 push:
7 branches: [main]
8 workflow_dispatch:
9
10 permissions: {}
11
12 concurrency:
13 group: pages-${{ github.event.pull_request.number || github.ref }}
14 cancel-in-progress: false
15
16 jobs:
17 build:
18 name: Test and build
19 runs-on: ubuntu-26.04
20 timeout-minutes: 30
21 permissions:
22 contents: read
23 env:
24 GIT_TERMINAL_PROMPT: '0'
25 steps:
26 - name: Check out source
27 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
28 with:
29 persist-credentials: false
30
31 - name: Set up Python
32 uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
33 with:
34 python-version: '3.14'
35
36 - name: Install native build dependencies
37 run: |
38 sudo apt-get update
39 sudo apt-get install --yes --no-install-recommends build-essential libmd4c-dev libmd4c-html0-dev libcurl4-openssl-dev libssl-dev zlib1g-dev util-linux
40 rustup toolchain install 1.99.1 --profile minimal --no-self-update
41 rustup default 1.99.1
42
43 - name: Restore patched Git
44 id: git-cache
45 uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
46 with:
47 path: .cache/secure-git/installed
48 key: git-ubuntu-26.04-${{ hashFiles('scripts/bootstrap_git.py') }}
49
50 - name: Build patched Git
51 if: steps.git-cache.outputs.cache-hit != 'true'
52 run: python scripts/bootstrap_git.py
53
54 - name: Select patched Git
55 run: |
56 echo "$GITHUB_WORKSPACE/.cache/secure-git/installed/bin" >> "$GITHUB_PATH"
57 .cache/secure-git/installed/bin/git --version
58
59 - name: Restore Cargo cache
60 uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
61 with:
62 path: |
63 ~/.cargo/registry
64 .cache/cargo
65 key: cargo-ubuntu-26.04-rust-1.99.1-${{ hashFiles('generator/Cargo.lock') }}
66
67 - name: Fetch locked dependencies
68 run: cargo fetch --locked --manifest-path generator/Cargo.toml
69
70 - name: Test Rust and build generator
71 run: |
72 cargo test --offline --locked --manifest-path generator/Cargo.toml --target-dir .cache/cargo
73 cargo build --release --offline --locked --manifest-path generator/Cargo.toml --target-dir .cache/cargo
74
75 - name: Run regression and security tests
76 run: |
77 python -m compileall -q scripts
78 python scripts/test_generator.py
79 python scripts/test_security.py
80 python scripts/test_package_site.py
81
82 - name: Build public repository browser
83 run: python scripts/build.py --base-url https://oni.sqzer.com
84 env:
85 GITHUB_TOKEN: ${{ github.token }}
86
87 - name: Verify generated site
88 run: python scripts/audit_site.py
89
90 - name: Package site including dot-prefixed repositories
91 run: python scripts/package_site.py --output "$RUNNER_TEMP/artifact.tar"
92
93 - name: Upload verified Pages artifact
94 if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
95 uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
96 with:
97 name: github-pages
98 path: ${{ runner.temp }}/artifact.tar
99 retention-days: 1
100 if-no-files-found: error
101
102 deploy:
103 name: Deploy to GitHub Pages
104 if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
105 needs: build
106 runs-on: ubuntu-26.04
107 timeout-minutes: 10
108 permissions:
109 pages: write
110 id-token: write
111 environment:
112 name: github-pages
113 url: ${{ steps.deployment.outputs.page_url }}
114 steps:
115 - name: Deploy verified artifact
116 id: deployment
117 uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1