feat: Direct-mode provisioning via supervisor-supplied token #26
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Documentation | |
| # Two distinct concerns: | |
| # | |
| # 1. On every PR: validate the .drawio files are well-formed XML and | |
| # conform to the mxfile schema, so a broken diagram fails CI before | |
| # review. No commit-back, no special permissions. | |
| # | |
| # 2. On push to master: render each .drawio to a .png and commit the | |
| # refreshed PNG. Requires `contents: write` on the workflow token, | |
| # which only lands when the workflow runs in the upstream repo (PRs | |
| # from forks intentionally skip this). | |
| # | |
| # We avoid running the render-and-commit job on PR branches because: | |
| # - commit-back to a PR branch from a fork is impossible from upstream | |
| # CI; | |
| # - PRs that touch the .drawio would otherwise either silently fail | |
| # the commit step or loop on auto-commits. | |
| on: | |
| pull_request: | |
| paths: | |
| - 'docs/**.drawio' | |
| - '.github/workflows/docs.yml' | |
| push: | |
| branches: [master] | |
| paths: | |
| - 'docs/**.drawio' | |
| - '.github/workflows/docs.yml' | |
| jobs: | |
| validate: | |
| name: Validate diagrams | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install xmllint | |
| run: sudo apt-get update && sudo apt-get install -y libxml2-utils | |
| - name: Fetch mxfile.xsd | |
| run: | | |
| curl -fsSL -o /tmp/mxfile.xsd \ | |
| https://raw.githubusercontent.com/jgraph/drawio-mcp/main/shared/mxfile.xsd | |
| - name: Validate every .drawio | |
| run: | | |
| set -e | |
| shopt -s globstar nullglob | |
| files=(docs/**/*.drawio) | |
| if [ ${#files[@]} -eq 0 ]; then | |
| echo "no .drawio files found under docs/" >&2 | |
| exit 0 | |
| fi | |
| for f in "${files[@]}"; do | |
| echo "Validating $f" | |
| xmllint --noout --schema /tmp/mxfile.xsd "$f" | |
| done | |
| render: | |
| name: Render PNGs and commit | |
| # Only on push to master; never on PR. We don't want to push commits | |
| # onto PR branches (fork-incompatible + recursion-prone), and the | |
| # validate job above already gates the .drawio shape. | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/master' | |
| needs: validate | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| # The default GITHUB_TOKEN can't push to master because the | |
| # branch ruleset requires PRs + status checks. Deploy keys are | |
| # allowed in the ruleset bypass list and stay usable when the | |
| # repo goes public (unlike the org-scoped APP_ID/APP_PEM | |
| # secrets, which only exist on private/internal repos). Check | |
| # out over SSH with a write-enabled deploy key; the auto-commit | |
| # action inherits the SSH remote for the push. | |
| - uses: actions/checkout@v4 | |
| with: | |
| ssh-key: ${{ secrets.DOCS_DEPLOY_KEY }} | |
| - name: Render diagrams to PNG | |
| uses: rlespinasse/drawio-export-action@v2 | |
| with: | |
| path: docs | |
| format: png | |
| output: . | |
| # Render directly next to the source, so docs/foo.drawio -> docs/foo.png. | |
| remove-page-suffix: true | |
| # The workflow's `paths:` filter already gates on a .drawio | |
| # change, so the action's default `auto` mode (which walks | |
| # git history and needs a non-shallow checkout) would be | |
| # redundant. Just render everything. | |
| action-mode: all | |
| - name: Commit refreshed PNGs | |
| uses: stefanzweifel/git-auto-commit-action@v5 | |
| with: | |
| commit_message: 'docs: regenerate diagrams [skip ci]' | |
| # git pathspec `docs/**/*.png` requires an intermediate | |
| # directory and so misses `docs/foo.png`. Listing both | |
| # depths doesn't help either — git add aborts (exit 128) on | |
| # *any* pathspec that matches nothing. We have no nested | |
| # diagrams, so just match top-level PNGs. | |
| file_pattern: 'docs/*.png' | |
| # Don't make an empty commit if nothing changed. | |
| skip_dirty_check: false |