ctdl-validate/.github/workflows/pages.yml at feat/github-action · ghzhost/ctdl-validate · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
name: Deploy playground

# Publishes web/ (the in-browser Pyodide validator) to GitHub Pages, together
# with a wheel built from the same commit.
#
# The wheel is built here rather than installed from PyPI on purpose, and the
# purpose is not that there is nothing on PyPI: ctdl-validate 0.1.0 has been
# there since 2026-08-13. It is that serving a wheel built from this commit,
# from this origin, means the playground can never run a different version of
# the validator than the source it is published beside. `main` is routinely
# ahead of the last tag, so installing the released package here would put a
# page and its own source out of step with each other silently. It also keeps
# the page's Content-Security-Policy down to two origins, with no connection to
# PyPI at all.
#
# One-time setup: Settings -> Pages -> Source: "GitHub Actions".

on:
  push:
    branches: [main]
    paths:
      - "web/**"
      - "src/**"
      - "pyproject.toml"
      - ".github/workflows/pages.yml"
  workflow_dispatch:

# Least-privilege default; the deploy job escalates only what it needs
# (CICD-04: write scopes job-level only).
permissions:
  contents: read

concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      UV_PYTHON: "3.12"
      UV_PYTHON_DOWNLOADS: never
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false # this job only reads; it never pushes
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
      - name: Build the wheel this page will run
        run: uv build --wheel --out-dir dist
      - name: Assemble the site
        # The manifest carries the wheel's filename so index.html never pins a
        # version: bumping pyproject's version changes the built filename and
        # the page follows it without an edit. Fails loudly if the build
        # produced anything other than exactly one wheel, because publishing a
        # page that fetches a wheel that is not there is a silent 404 at boot.
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          wheels=(dist/*.whl)
          if [ "${#wheels[@]}" -ne 1 ]; then
            echo "::error title=unexpected build output::expected exactly one wheel, found ${#wheels[@]}"
            exit 1
          fi
          wheel="$(basename "${wheels[0]}")"
          version="$(uv version --short 2>/dev/null || python -c 'import tomllib;print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')"
          mkdir -p site
          cp web/index.html site/
          cp "${wheels[0]}" site/
          printf '{"wheel": "%s", "version": "%s"}\n' "$wheel" "$version" > site/wheel.json
          echo "publishing $wheel (version $version)"
      - name: Verify the page can find what it fetches
        # Cheap guard against the failure mode this layout invites: index.html
        # fetching a name that is not in the artifact.
        shell: bash
        run: |
          set -euo pipefail
          wheel="$(python -c 'import json;print(json.load(open("site/wheel.json"))["wheel"])')"
          test -f "site/$wheel" || { echo "::error::wheel.json names $wheel but it is not in site/"; exit 1; }
          grep -q 'fetch("wheel.json")' site/index.html || { echo "::error::index.html no longer fetches wheel.json"; exit 1; }
      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: site

  deploy:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      pages: write # publish the built site to GitHub Pages
      id-token: write # OIDC to prove this workflow run produced the artifact
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0