flashtrace.github.io/.github/workflows/deploy.yml at main · flashtrace/flashtrace.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
name: Deploy site

on:
  push:
    branches: [main]
  workflow_dispatch: {}
  # fired by flashtrace/flashtrace's release workflow after every release,
  # with client_payload.tag = the new release tag
  repository_dispatch:
    types: [flashtrace-release]

permissions:
  contents: read
  pages: write
  id-token: write
  # for the schema problem report in the build job below
  issues: write

concurrency:
  group: pages
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      # docs are built from the released tool, not its main branch: take the
      # tag from the dispatch payload, or fall back to the latest release.
      # An empty tag would make the checkout below silently use the default
      # branch, so fail loudly instead.
      - name: Resolve flashtrace release ref
        id: ref
        run: |
          tag="$RAW_TAG"
          if [ -z "$tag" ]; then
            tag=$(gh release view --repo flashtrace/flashtrace --json tagName --jq .tagName) || true
          fi
          if [ -z "$tag" ]; then
            echo "::error::no release tag: dispatch payload was empty and flashtrace/flashtrace has no published release"
            exit 1
          fi
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
        env:
          # env, not inline ${{ }}: the dispatch payload is untrusted input and
          # must reach the shell as data, never as script text
          RAW_TAG: ${{ github.event.client_payload.tag }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: flashtrace/flashtrace
          ref: ${{ steps.ref.outputs.tag }}
          path: flashtrace

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - run: pnpm build
        env:
          FLASHTRACE_REF: ${{ steps.ref.outputs.tag }}

      # The build skips a schema it cannot serve instead of failing, so without
      # this a broken schema would ship as a green deploy and nobody would know.
      # continue-on-error: reporting the problem must never become a worse
      # problem than the one being reported.
      - name: Report skipped schemas
        if: always()
        continue-on-error: true
        run: node .github/scripts/report-schema-problems.mjs
        env:
          REPORT_ISSUE: '1'
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: dist

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deploy.outputs.page_url }}
    steps:
      - id: deploy
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0