plumbline/.github/workflows/pages.yml at main · ghzhost/plumbline · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# Publish the committed evidence page.
#
# The page is `site/index.html`, generated by `tools/build_site.py` from the
# committed audit report and the committed defect-injection proof — and by
# *running* the refusals it renders, in a temporary copy of this repository's
# own evidence. What is deployed is the reviewed file in the repository, not
# something this job invents.
#
# The build step is a check, not a build: it regenerates the page and fails if
# a single byte differs from the committed one. A published report that had
# drifted from the committed report would be a provenance claim nobody can
# back, which is the one thing this repository may not ship. The same check
# runs in `tests/test_site.py` on every test run, together with a test proving
# it can fail. `tools/check_site_a11y.py` then holds this page to the same
# structural accessibility standard `accessibility.py` holds a target's
# interface to, checked again in `tests/test_site_a11y.py`.
#
# This workflow does not enable Pages. Until the repository's Pages source is
# set to "GitHub Actions", it will run and its deploy step will fail; that is
# the correct order, because enabling Pages is a settings change and this file
# is a reviewable one. Once it is set, the page is served at
# https://chelseakr.github.io/plumbline/ — link it from README.md then, and not
# before: a link to a 404 is the kind of claim this repository does not make.

name: pages

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

# One deployment at a time, and never cancel one in flight: a half-published
# page is a worse artifact than a stale one.
concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      # Fails if the committed page is not what the committed evidence
      # produces, and refuses to build at all if any drill it renders comes
      # back with a different exit code.
      - name: The page must be what the committed evidence produces
        run: python3 tools/build_site.py --check

      # Refuses to deploy a page that fails its own accessibility standard.
      - name: The page must pass its own accessibility checks
        run: PYTHONPATH=src python3 tools/check_site_a11y.py

      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: site

  deploy:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0