Deploy to GitHub Pages #1724
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy to GitHub Pages | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '17 * * * *' | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: public-docs-deploy | |
| cancel-in-progress: true | |
| jobs: | |
| deploy: | |
| name: Deploy to GitHub Pages | |
| if: >- | |
| github.repository == 'durable-workflow/durable-workflow.github.io' && | |
| github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - name: Verify current public artifact tuple | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: node scripts/refresh-public-artifact-versions.js --check | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Set up Helm | |
| uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5 | |
| with: | |
| version: v3.16.2 | |
| - name: Plan deployment | |
| id: deploy-plan | |
| env: | |
| DOCS_DEPLOY_EVENT_NAME: ${{ github.event_name }} | |
| run: node scripts/plan-docs-deploy.js | |
| - name: Resolve qualified Server authority ref | |
| id: server-authority | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| run: | | |
| node -e "process.stdout.write('ref=' + require('./scripts/public-artifact-versions.json').artifacts.server + '\n')" >> "$GITHUB_OUTPUT" | |
| - name: Checkout qualified Server authority | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| repository: ${{ github.repository_owner }}/server | |
| ref: ${{ steps.server-authority.outputs.ref }} | |
| path: .server-authority | |
| persist-credentials: false | |
| - name: Resolve Workflow authority ref | |
| id: workflow-authority | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| run: | | |
| node -e "process.stdout.write('ref=' + require('./scripts/public-artifact-versions.json').artifacts.workflow + '\n')" >> "$GITHUB_OUTPUT" | |
| - name: Checkout Workflow authority | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| repository: durable-workflow/workflow | |
| ref: ${{ steps.workflow-authority.outputs.ref }} | |
| path: .workflow-authority | |
| persist-credentials: false | |
| - name: Resolve published Workflow conformance ref | |
| id: published-workflow | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| run: | | |
| node -e "process.stdout.write('ref=' + require('./scripts/published-artifact-versions.json').artifacts.workflow + '\n')" >> "$GITHUB_OUTPUT" | |
| - name: Checkout published Workflow conformance authority | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| repository: ${{ github.repository_owner }}/workflow | |
| ref: ${{ steps.published-workflow.outputs.ref }} | |
| path: .published-workflow-authority | |
| persist-credentials: false | |
| - name: Verify pinned server protocol catalog | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| env: | |
| PUBLIC_SERVER_PROTOCOL_CATALOG_EVIDENCE: public-server-protocol-catalog-conformance.json | |
| PUBLIC_SERVER_SOURCE_PATH: ${{ github.workspace }}/.server-authority | |
| run: node scripts/check-public-server-protocol-catalog.js | |
| - name: Upload pinned server protocol catalog evidence | |
| if: ${{ always() && steps.deploy-plan.outputs.deploy == 'true' }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: public-server-protocol-catalog-conformance | |
| path: | | |
| public-server-protocol-catalog-conformance.json | |
| public-server-protocol-catalog-bootstrap.log | |
| public-server-protocol-catalog-server.log | |
| if-no-files-found: error | |
| - name: Build website | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| WORKFLOW_SDK_NEUTRALITY_MANIFEST_PATH: ${{ github.workspace }}/.workflow-authority/resources/sdk-neutrality-contract.json | |
| WORKFLOW_PLATFORM_CONFORMANCE_MANIFEST_PATH: ${{ github.workspace }}/.published-workflow-authority/resources/platform-conformance-contract.json | |
| run: npm run build | |
| - name: Set up Docker Buildx | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 | |
| - name: Guard Helm chart immutability and stage the HTTPS repository | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| run: node scripts/helm-chart-release.js pre-deploy | |
| - name: Verify public artifact tuple | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| run: | | |
| node <<'NODE' | |
| const assert = require('assert'); | |
| const fs = require('fs'); | |
| const recommended = require('./scripts/public-artifact-versions.json').artifacts; | |
| const published = require('./scripts/published-artifact-versions.json').artifacts; | |
| const audit = JSON.parse(fs.readFileSync('build/docs-page-release-audit.json', 'utf8')); | |
| const narrative = JSON.parse(fs.readFileSync('build/docs-narrative-audit.json', 'utf8')); | |
| const quickstart = JSON.parse(fs.readFileSync('build/quickstart-execution-contract.json', 'utf8')); | |
| for (const [name, version] of Object.entries(published)) { | |
| assert.strictEqual( | |
| audit.artifact_versions && audit.artifact_versions[name], | |
| version, | |
| `docs-page-release-audit.json artifact_versions.${name}` | |
| ); | |
| assert.strictEqual( | |
| narrative.artifact_versions && narrative.artifact_versions[name], | |
| version, | |
| `docs-narrative-audit.json artifact_versions.${name}` | |
| ); | |
| } | |
| for (const [name, version] of Object.entries(recommended)) { | |
| assert.strictEqual( | |
| quickstart.artifacts && quickstart.artifacts[name] && quickstart.artifacts[name].version, | |
| version, | |
| `quickstart-execution-contract.json artifacts.${name}.version` | |
| ); | |
| } | |
| assert.strictEqual( | |
| audit.release_status_guardrail && | |
| audit.release_status_guardrail.stable_default_docs_version, | |
| '1.x', | |
| 'release audit stable default docs version' | |
| ); | |
| assert.strictEqual( | |
| quickstart.default_docs_guard && | |
| quickstart.default_docs_guard.stable_default_docs_version, | |
| '1.x', | |
| 'quickstart stable default docs version' | |
| ); | |
| assert.strictEqual( | |
| narrative.release_status_guardrail && | |
| narrative.release_status_guardrail.stable_default_docs_version, | |
| '1.x', | |
| 'narrative audit stable default docs version' | |
| ); | |
| assert.strictEqual( | |
| narrative.release_status_guardrail && | |
| narrative.release_status_guardrail.explicit_prerelease_docs_version, | |
| '2.0', | |
| 'narrative audit explicit prerelease docs version' | |
| ); | |
| assert.strictEqual( | |
| narrative.docs_revision, | |
| audit.docs_revision, | |
| 'narrative and release audit docs revisions' | |
| ); | |
| assert.strictEqual( | |
| narrative.summary && narrative.summary.markdown_sources, | |
| narrative.route_inventory && narrative.route_inventory.length, | |
| 'narrative audit Markdown source count matches the built route inventory' | |
| ); | |
| console.log( | |
| `Deploying current published component artifacts: ${Object.entries(published) | |
| .map(([name, version]) => `${name}=${version}`) | |
| .join(', ')}` | |
| ); | |
| console.log( | |
| `Retaining qualified aggregate recommendation: ${Object.entries(recommended) | |
| .map(([name, version]) => `${name}=${version}`) | |
| .join(', ')}` | |
| ); | |
| NODE | |
| # Popular action to deploy to GitHub Pages: | |
| # Docs: https://github.com/peaceiris/actions-gh-pages#%EF%B8%8F-docusaurus | |
| - name: Deploy to GitHub Pages | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| # Build output to publish to the `gh-pages` branch: | |
| publish_dir: ./build | |
| # The following lines assign commit authorship to the official | |
| # GH-Actions bot for deploys to `gh-pages` branch: | |
| # https://github.com/actions/checkout/issues/13#issuecomment-724415212 | |
| # The GH actions bot is used by default if you didn't specify the two fields. | |
| # You can swap them out with your own user credentials. | |
| user_name: github-actions[bot] | |
| user_email: 41898282+github-actions[bot]@users.noreply.github.com | |
| force_orphan: true | |
| - name: Verify live docs release audit | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| run: node scripts/verify-docs-release-live.js | |
| - name: Verify live workflow lifecycle authority | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| run: node scripts/verify-workflow-lifecycle-live.js | |
| - name: Verify both public Helm release channels | |
| if: steps.deploy-plan.outputs.deploy == 'true' | |
| run: node scripts/helm-chart-release.js verify-live | |
| - name: Upload public Helm validation evidence | |
| if: ${{ always() && steps.deploy-plan.outputs.deploy == 'true' }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: public-helm-release-validation | |
| path: | | |
| helm-predeploy-immutability-evidence.json | |
| helm-public-validation-evidence.json | |
| if-no-files-found: error | |
| - name: Report current live tuple | |
| if: steps.deploy-plan.outputs.deploy != 'true' | |
| run: echo "Live public artifact tuple already matches main; skipping scheduled deploy." |