ci: apply org-wide Actions/Dependabot policy (OPS-18) (#20) #45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Documentation | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '17 5 * * 1' | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: docs-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 1 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| enable-cache: false | |
| python-version: "3.12" | |
| - run: uv sync --locked | |
| - run: uv run ruff check scripts tests | |
| - run: uv run ruff format --check scripts tests | |
| - run: uv run pytest -q | |
| - run: uv run python scripts/export_ecosystem.py --check | |
| - run: uv run python scripts/check_release_freshness.py | |
| - run: uv run zensical build --clean --strict | |
| - run: uv run python scripts/write_headers.py site | |
| - run: uv run python scripts/check_site.py site | |
| - uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0 | |
| with: | |
| args: >- | |
| --verbose | |
| --no-progress | |
| --accept 200,206,429 | |
| --root-dir ./site | |
| './site/**/*.html' | |
| fail: true | |
| lycheeVersion: v0.24.2 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| audit-dependencies: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 1 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| python-version: "3.12" | |
| - run: uv sync --locked | |
| - run: uv run --with pip-audit==2.10.0 pip-audit | |
| lint-workflows: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 1 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| - run: uvx zizmor==1.28.0 .github/workflows | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| deploy: | |
| if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' | |
| needs: [build, audit-dependencies, lint-workflows] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| environment: | |
| name: cloudflare-production | |
| url: https://hayatepy.dev/ | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| enable-cache: false | |
| python-version: "3.12" | |
| - run: uv sync --locked | |
| - run: uv run zensical build --clean --strict | |
| - run: uv run python scripts/write_headers.py site | |
| - id: deploy | |
| if: env.CLOUDFLARE_API_TOKEN != '' | |
| uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0 | |
| with: | |
| apiToken: ${{ env.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} | |
| wranglerVersion: "4.114.0" | |
| - id: deploy-http-redirect | |
| if: env.CLOUDFLARE_API_TOKEN != '' | |
| uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0 | |
| with: | |
| apiToken: ${{ env.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} | |
| command: deploy --config wrangler.redirect.jsonc | |
| wranglerVersion: "4.114.0" | |
| - if: env.CLOUDFLARE_API_TOKEN == '' | |
| run: >- | |
| echo "::warning::Cloudflare deploy skipped because | |
| CLOUDFLARE_API_TOKEN is not configured" |