diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 0ec16040..33df9c51 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -68,18 +68,38 @@ jobs: sed -i 's|url: "https://social.dp.chanterelle.xyz"|url: "${{ vars.SOCIAL_DP_STAGING }}"|' _config.yml fi - # Decode the correct key based on the branch + # Decode the correct key based on the branch. + # Dependabot- and fork-triggered PR runs don't receive repository + # secrets, so PR builds fall back to a throwaway key — it's only used to + # build, never to publish. Push builds must have the real secret and + # fail hard if it's missing. - name: Decode Staging Key if: > github.ref == 'refs/heads/staging' || (github.event_name == 'pull_request' && github.base_ref == 'staging') - run: echo ${{ secrets.ENCODED_DP_AP_KEY_STAGING }} | base64 --decode > /tmp/secret.key + run: | + if [ -n "${{ secrets.ENCODED_DP_AP_KEY_STAGING }}" ]; then + echo ${{ secrets.ENCODED_DP_AP_KEY_STAGING }} | base64 --decode > /tmp/secret.key + elif [ "${{ github.event_name }}" = "pull_request" ]; then + openssl genrsa -out /tmp/secret.key 2048 + else + echo "ENCODED_DP_AP_KEY_STAGING is empty on a push build; refusing to deploy with a throwaway key" >&2 + exit 1 + fi - name: Decode Production Key if: > github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.base_ref == 'master') - run: echo ${{ secrets.ENCODED_DP_AP_KEY_PRODUCTION }} | base64 --decode > /tmp/secret.key + run: | + if [ -n "${{ secrets.ENCODED_DP_AP_KEY_PRODUCTION }}" ]; then + echo ${{ secrets.ENCODED_DP_AP_KEY_PRODUCTION }} | base64 --decode > /tmp/secret.key + elif [ "${{ github.event_name }}" = "pull_request" ]; then + openssl genrsa -out /tmp/secret.key 2048 + else + echo "ENCODED_DP_AP_KEY_PRODUCTION is empty on a push build; refusing to deploy with a throwaway key" >&2 + exit 1 + fi - name: Build Jekyll Site for Staging if: github.ref == 'refs/heads/staging' || (github.event_name == 'pull_request' && github.base_ref == 'staging') @@ -116,12 +136,14 @@ jobs: refresh_token: ${{ secrets.DISTRIBUTED_PRESS_PRODUCTION_TOKEN}} site_url: hypha.coop + # Push-only: notifying the Fediverse and committing generated data are + # side effects that must not run for unmerged PRs targeting master. - name: Notify AP - if: github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.base_ref == 'master') + if: github.event_name == 'push' && github.ref == 'refs/heads/master' run: bundle exec jekyll notify --key /tmp/secret.key --verbose --trace - name: Commit ActivityPub and Sequoia Data - if: github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.base_ref == 'master') + if: github.event_name == 'push' && github.ref == 'refs/heads/master' uses: EndBug/add-and-commit@v9 with: add: '_data/activity_pub.yml,.sequoia-state.json,_posts' diff --git a/Gemfile b/Gemfile index cf95c1be..747be833 100644 --- a/Gemfile +++ b/Gemfile @@ -14,7 +14,7 @@ gem "html-proofer" gem 'nokogiri' # gem 'ruby-brs' gem "webrick", "~> 1.9" -gem 'sutty-liquid', '~> 0.12.2' +gem 'sutty-liquid', '~> 0.13.0' group :jekyll_plugins do gem "jekyll-feed", diff --git a/Gemfile.lock b/Gemfile.lock index ad6131d7..d52f8477 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -9,16 +9,29 @@ GIT GEM remote: https://rubygems.org/ specs: - addressable (2.8.7) - public_suffix (>= 2.0.2, < 7.0) - base64 (0.2.0) - bigdecimal (3.1.9) + Ascii85 (2.0.1) + addressable (2.9.0) + public_suffix (>= 2.0.2, < 8.0) + afm (1.0.0) + async (2.42.0) + console (~> 1.29) + fiber-annotation + io-event (~> 1.11) + metrics (~> 0.12) + traces (~> 0.18) + base64 (0.3.0) + benchmark (0.5.0) + bigdecimal (3.3.1) climate_control (1.2.0) colorator (1.1.0) - concurrent-ruby (1.3.5) - crass (1.0.6) - csv (3.3.0) - distributed-press-api-client (0.5.1) + concurrent-ruby (1.3.7) + console (1.36.0) + fiber-annotation + fiber-local (~> 1.1) + json + crass (1.0.7) + csv (3.3.5) + distributed-press-api-client (0.5.4) addressable (~> 2.3, >= 2.3.0) climate_control dry-schema @@ -27,28 +40,30 @@ GEM json (~> 2.1, >= 2.1.0) jwt (~> 2.6.0) nokogiri (~> 1.16) - dry-configurable (1.2.0) - dry-core (~> 1.0, < 2) + dry-configurable (1.4.0) + dry-core (~> 1.0) zeitwerk (~> 2.6) - dry-core (1.0.1) + dry-core (1.2.0) concurrent-ruby (~> 1.0) + logger zeitwerk (~> 2.6) - dry-inflector (1.1.0) - dry-initializer (3.1.1) - dry-logic (1.5.0) + dry-inflector (1.3.1) + dry-initializer (3.2.0) + dry-logic (1.6.0) + bigdecimal concurrent-ruby (~> 1.0) - dry-core (~> 1.0, < 2) + dry-core (~> 1.1) zeitwerk (~> 2.6) - dry-schema (1.13.4) + dry-schema (1.16.0) concurrent-ruby (~> 1.0) dry-configurable (~> 1.0, >= 1.0.1) - dry-core (~> 1.0, < 2) - dry-initializer (~> 3.0) - dry-logic (>= 1.4, < 2) - dry-types (>= 1.7, < 2) + dry-core (~> 1.1) + dry-initializer (~> 3.2) + dry-logic (~> 1.6) + dry-types (~> 1.9, >= 1.9.1) zeitwerk (~> 2.6) - dry-types (1.7.2) - bigdecimal (~> 3.0) + dry-types (1.9.1) + bigdecimal (>= 3.0) concurrent-ruby (~> 1.0) dry-core (~> 1.0) dry-inflector (~> 1.0) @@ -61,32 +76,40 @@ GEM ffi (>= 1.15.0) eventmachine (1.2.7) fast_blank (1.0.1) - ffi (1.17.1-x86_64-darwin) - ffi (1.17.1-x86_64-linux-gnu) + ffi (1.17.4-x86_64-darwin) + ffi (1.17.4-x86_64-linux-gnu) + fiber-annotation (0.2.0) + fiber-local (1.1.0) + fiber-storage + fiber-storage (1.0.1) forwardable-extended (2.6.0) - google-protobuf (4.29.3-x86_64-darwin) + google-protobuf (4.35.1-x86_64-darwin) bigdecimal - rake (>= 13) - google-protobuf (4.29.3-x86_64-linux) + rake (~> 13.3) + google-protobuf (4.35.1-x86_64-linux-gnu) bigdecimal - rake (>= 13) - html-proofer (3.19.4) + rake (~> 13.3) + hashery (2.1.2) + html-proofer (5.2.1) addressable (~> 2.3) - mercenary (~> 0.3) + async (~> 2.1) + benchmark (~> 0.5) nokogiri (~> 1.13) - parallel (~> 1.10) + pdf-reader (~> 2.11) rainbow (~> 3.0) typhoeus (~> 1.3) yell (~> 2.0) - http_parser.rb (0.8.0) - httparty (0.22.0) + zeitwerk (~> 2.5) + http_parser.rb (0.8.1) + httparty (0.24.2) csv mini_mime (>= 1.0.0) multi_xml (>= 0.5.2) httparty-cache (0.0.6) httparty (~> 0.18) - i18n (1.14.7) + i18n (1.15.2) concurrent-ruby (~> 1.0) + io-event (1.19.1) jekyll (4.4.1) addressable (~> 2.4) base64 (~> 0.2) @@ -106,69 +129,80 @@ GEM safe_yaml (~> 1.0) terminal-table (>= 1.8, < 4.0) webrick (~> 1.7) - jekyll-activity-pub (0.3.3) + jekyll-activity-pub (0.3.6) distributed-press-api-client (~> 0.5.0) jekyll (~> 4) marcel (~> 1) - jekyll-sass-converter (3.0.0) - sass-embedded (~> 1.54) + jekyll-sass-converter (3.1.0) + sass-embedded (~> 1.75) jekyll-watch (2.2.1) listen (~> 3.0) - json (2.7.2) + json (2.20.0) jwt (2.6.0) - kramdown (2.5.1) - rexml (>= 3.3.9) + kramdown (2.5.2) + rexml (>= 3.4.4) kramdown-parser-gfm (1.1.0) kramdown (~> 2.0) liquid (4.0.4) - listen (3.9.0) + listen (3.10.0) + logger rb-fsevent (~> 0.10, >= 0.10.3) rb-inotify (~> 0.9, >= 0.9.10) logger (1.7.0) - loofah (2.24.0) + loofah (2.25.1) crass (~> 1.0.2) nokogiri (>= 1.12.0) - marcel (1.0.4) + marcel (1.2.1) mercenary (0.4.0) + metrics (0.15.0) mini_mime (1.1.5) - multi_xml (0.7.1) - bigdecimal (~> 3.1) - nokogiri (1.18.7-x86_64-darwin) + multi_xml (0.9.1) + bigdecimal (>= 3.1, < 5) + nokogiri (1.19.4-x86_64-darwin) racc (~> 1.4) - nokogiri (1.18.7-x86_64-linux-gnu) + nokogiri (1.19.4-x86_64-linux-gnu) racc (~> 1.4) - parallel (1.22.1) pathutil (0.16.2) forwardable-extended (~> 2.6) - public_suffix (6.0.1) + pdf-reader (2.15.1) + Ascii85 (>= 1.0, < 3.0, != 2.0.0) + afm (>= 0.2.1, < 2) + hashery (~> 2.0) + ruby-rc4 + ttfunk + public_suffix (7.0.5) racc (1.8.1) rails-html-sanitizer (1.6.2) loofah (~> 2.21) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) rainbow (3.1.1) - rake (13.2.1) + rake (13.4.2) rb-fsevent (0.11.2) rb-inotify (0.11.1) ffi (~> 1.0) - rexml (3.4.0) - rouge (4.5.1) + rexml (3.4.4) + rouge (4.7.0) + ruby-rc4 (0.1.5) safe_yaml (1.0.5) - sass-embedded (1.83.4-x86_64-darwin) - google-protobuf (~> 4.29) - sass-embedded (1.83.4-x86_64-linux-gnu) - google-protobuf (~> 4.29) - sutty-liquid (0.12.3) + sass-embedded (1.101.0-x86_64-darwin) + google-protobuf (~> 4.31) + sass-embedded (1.101.0-x86_64-linux-gnu) + google-protobuf (~> 4.31) + sutty-liquid (0.13.0) fast_blank (~> 1.0) jekyll (~> 4) rails-html-sanitizer (~> 1.6.0) terminal-table (3.0.2) unicode-display_width (>= 1.1.1, < 3) + traces (0.18.2) + ttfunk (1.8.0) + bigdecimal (~> 3.1) typhoeus (1.4.0) ethon (>= 0.9.0) unicode-display_width (2.6.0) - webrick (1.9.1) + webrick (1.9.2) yell (2.2.2) - zeitwerk (2.6.17) + zeitwerk (2.8.2) PLATFORMS x86_64-darwin-20 @@ -181,7 +215,7 @@ DEPENDENCIES jekyll-feed! logger nokogiri - sutty-liquid (~> 0.12.2) + sutty-liquid (~> 0.13.0) webrick (~> 1.9) BUNDLED WITH diff --git a/Makefile b/Makefile index 76ef4ec3..22998d03 100644 --- a/Makefile +++ b/Makefile @@ -3,13 +3,13 @@ RUN = bundle exec start: ## Run jekyll server $(RUN) jekyll serve --watch -check: ## Check with htmlproofer +check: ## Check with htmlproofer (5.x flags: --check-html removed, --internal-domains replaced by --swap-urls) $(RUN) htmlproofer ./_site \ - --check-html \ --allow-hash-href \ - --disable_external \ - --typhoeus-config '{ "headers": { "User-Agent": "Mozilla/5.0 (X11; Linux i686; rv:84.0) Gecko/20100101 Firefox/84.0" } }' \ - --internal-domains hypha.coop + --allow-missing-href \ + --disable-external \ + --no-enforce-https \ + --swap-urls "https\://hypha.coop:,https\://staging.hypha.coop:" build: ## Build for web @if [ "$(JEKYLL_ENV)" = "staging" ]; then \ diff --git a/_includes/picture.html b/_includes/picture.html index eeceb073..60ba1d8a 100644 --- a/_includes/picture.html +++ b/_includes/picture.html @@ -10,18 +10,21 @@ @param :img_class [String] {%- endcomment -%} +{%- capture srcset -%} + {%- for pixel_density in site.data.theme.pixel_densities %} + {% if include.width %} + {%- assign w = include.width | times: pixel_density -%} + {% elsif include.height %} + {%- assign h = include.height | times: pixel_density -%} + {% endif %} + {{- include.src | thumbnail: w, h | uri_escape }} {{ pixel_density }}x, + {% endfor -%} +{%- endcapture -%} +{%- assign srcset = srcset | strip -%} - + {%- if srcset != "" %} + + {%- endif %}