disclosed/.github/workflows/pages.yml at master · ghzhost/disclosed · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: publish-site

# The site is a build artifact, not a tracked directory: `disclosed site` renders it from
# data/report.json, data/national.json and data/scorecard-census.json, all three committed. So
# this workflow needs no network, no API key, and no secrets, and the published pages are
# reproducible from the commit they were built at.
#
# The origin stamped into the 617 canonical links, the sitemap and robots.txt is taken from the
# deploy target the Pages API reports, not from a constant in the source. Issue #2 was those
# URLs naming a host that served a 404, and the reason it went unnoticed for so long is that
# nothing in the build compared the two. `check_site_origin.py` now does, and fails the build
# when they disagree.

on:
  push:
    branches: [main, master]
  workflow_dispatch:

permissions: {}

concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Read-only, and only so `configure-pages` can ask where this site is served from.
      pages: read
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - name: Install
        run: python -m pip install -e .

      # Ask where this site is actually served from, before rendering anything that claims it.
      - id: pages
        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5

      - name: Resolve the deploy target
        env:
          # Via the environment rather than inline `${{ }}`, so the value is data and never
          # becomes part of the script.
          BASE_URL: ${{ steps.pages.outputs.base_url }}
        run: |
          base_url="${BASE_URL%/}"
          if [ -z "$base_url" ]; then
            echo "::error::Pages did not report a base URL, so there is nothing to stamp into" \
                 "the canonical links. Refusing to publish a site that names an origin nobody" \
                 "confirmed."
            exit 1
          fi
          echo "SITE_ORIGIN=$base_url" >> "$GITHUB_ENV"
          echo "Deploy target: $base_url"

      - name: Render the site from committed data
        run: >
          python -m disclosed.cli site
          --report data/report.json
          --national data/national.json
          --scorecard-census data/scorecard-census.json
          --out site
          --origin "$SITE_ORIGIN"
          --generated "$(date -u +%F)"
      - name: Fail if the render produced nothing
        run: test -s site/index.html
      - name: Fail if the site's URLs disagree with the deploy target
        run: python .github/scripts/check_site_origin.py site "$SITE_ORIGIN"

      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
        with:
          path: site

  deploy:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - id: deployment
        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4