feat(ci): harden the supply chain and build the server once #2284
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CD / Docs | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "docs/**" | |
| - ".github/workflows/cd-docs.yml" | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| paths: | |
| - "docs/**" | |
| - ".github/workflows/cd-docs.yml" | |
| workflow_dispatch: | |
| concurrency: | |
| group: docs-deploy-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| build-preview: | |
| name: Build (preview) | |
| if: github.event_name == 'pull_request' | |
| timeout-minutes: 15 | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/setup-node-pnpm | |
| with: | |
| install: "frozen" | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| docs/.docusaurus | |
| docs/node_modules/.cache | |
| key: ${{ runner.os }}-docusaurus-preview-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('docs/**/*.md', 'docs/**/*.mdx', 'docs/**/*.ts') }} | |
| restore-keys: | | |
| ${{ runner.os }}-docusaurus-preview-${{ hashFiles('pnpm-lock.yaml') }}- | |
| ${{ runner.os }}-docusaurus-preview- | |
| - run: pnpm --filter docs run build | |
| env: | |
| DOCUSAURUS_BASE_URL: "/" | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: docs-build-preview | |
| path: docs/build | |
| retention-days: 1 | |
| build-production: | |
| name: Build (production) | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| timeout-minutes: 15 | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/setup-node-pnpm | |
| with: | |
| install: "frozen" | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| docs/.docusaurus | |
| docs/node_modules/.cache | |
| key: ${{ runner.os }}-docusaurus-production-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('docs/**/*.md', 'docs/**/*.mdx', 'docs/**/*.ts') }} | |
| restore-keys: | | |
| ${{ runner.os }}-docusaurus-production-${{ hashFiles('pnpm-lock.yaml') }}- | |
| ${{ runner.os }}-docusaurus-production- | |
| - run: pnpm --filter docs run build | |
| env: | |
| DOCUSAURUS_BASE_URL: "/" | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: docs-build-production | |
| path: docs/build | |
| retention-days: 1 | |
| preview: | |
| name: PR Preview | |
| needs: build-preview | |
| if: github.event_name == 'pull_request' | |
| timeout-minutes: 10 | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| statuses: write | |
| env: | |
| PREVIEW_URL: ls1intum-hephaestus-docs-pr-${{ github.event.number }}.surge.sh | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: docs-build-preview | |
| path: docs-build | |
| - uses: ./.github/actions/setup-node-pnpm | |
| with: | |
| install: "hardened" | |
| - name: Deploy to Surge.sh | |
| env: | |
| SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }} | |
| run: ./node_modules/.bin/surge ./docs-build "$PREVIEW_URL" --token "$SURGE_TOKEN" | |
| - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 | |
| with: | |
| header: docs-preview | |
| message: | | |
| ## 📚 Documentation Preview | |
| This PR includes documentation changes. A preview has been deployed: | |
| 🔗 **[View Docs Preview](https://${{ env.PREVIEW_URL }})** | |
| <sub>Preview for commit ${{ github.event.pull_request.head.sha }}. Updates automatically on new commits.</sub> | |
| - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| env: | |
| TARGET_URL: https://${{ env.PREVIEW_URL }} | |
| with: | |
| script: | | |
| const sha = context.payload.pull_request?.head?.sha || context.sha; | |
| await github.rest.repos.createCommitStatus({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| sha: sha, | |
| state: 'success', | |
| target_url: process.env.TARGET_URL, | |
| description: 'Click Details to view Docs Preview', | |
| context: 'Preview / Docs' | |
| }); | |
| deploy: | |
| name: GitHub Pages | |
| needs: build-production | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| timeout-minutes: 10 | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| pages: write | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: docs-build-production | |
| path: docs-build | |
| - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 | |
| with: | |
| path: docs-build | |
| - id: deployment | |
| uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 |