mirror of
https://github.com/d4rken-org/capod.git
synced 2026-09-15 02:36:12 -04:00
darken
ff8b9cf6ed
release: published events triggered by secrets.GITHUB_TOKEN do not start new workflow runs (only workflow_dispatch and repository_dispatch are exceptions). The Pages workflow's release: published trigger would never have fired in production since release-tag.yml's softprops/action-gh-release uses GITHUB_TOKEN to publish. Fix: drop the release: published trigger and have release-tag.yml's release-github job explicitly run gh workflow run pages.yml --ref main after the release is created. release-github gains actions: write to authorize the dispatch. Also adopts refinements from sibling org PRs (permission-pilot#356, bluemusic#220): - Top-level permissions reduced to contents: read; pages: write and id-token: write moved to the deploy job only (least privilege) - JEKYLL_GITHUB_TOKEN on the build step so jekyll-github-metadata authenticates when fetching site.github.releases - Sanity-check step (test -f _site/index.html && _site/CNAME) fails fast if Jekyll produced nothing - Explicit upload-pages-artifact path: ./_site matches the build's destination - Verify fastlane Bundler wiring step (bundle exec fastlane --version) lets workflow_dispatch dry_run=true exercise the relocated Gemfile before the next real release
56 lines
1.4 KiB
YAML
56 lines
1.4 KiB
YAML
name: Deploy GitHub Pages
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: pages
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
build:
|
|
name: Build Jekyll site
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout source code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure Pages
|
|
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d #v6.0.0
|
|
|
|
- name: Build with Jekyll
|
|
uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 #v1.0.13
|
|
with:
|
|
source: ./
|
|
destination: ./_site
|
|
env:
|
|
JEKYLL_GITHUB_TOKEN: ${{ github.token }}
|
|
|
|
- name: Sanity-check Jekyll output
|
|
run: test -f _site/index.html && test -f _site/CNAME
|
|
|
|
- name: Upload Pages artifact
|
|
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 #v5.0.0
|
|
with:
|
|
path: ./_site
|
|
|
|
deploy:
|
|
name: Deploy to GitHub Pages
|
|
needs: build
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
pages: write
|
|
id-token: write
|
|
environment:
|
|
name: github-pages
|
|
url: ${{ steps.deployment.outputs.page_url }}
|
|
steps:
|
|
- name: Deploy to GitHub Pages
|
|
id: deployment
|
|
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 #v5.0.0
|