ci: pin actions to full-length commit SHAs (#94) #165
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & Deploy Docs | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Allow the deploy job to publish to GitHub Pages. | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| # Scoped per ref, so a PR build only ever supersedes an older build of the | |
| # SAME pull request (github.ref is refs/pull/<n>/merge). A single constant | |
| # group here would make every queued run cancel the previously pending one | |
| # across unrelated PRs, and `build` is a required status check — a cancelled | |
| # run is not a success, so that would block merges until a manual re-run. | |
| concurrency: | |
| group: build-${{ github.ref }} | |
| cancel-in-progress: true | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: '22' | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build site (Antora) | |
| run: npm run antora | |
| - name: Test (go.php redirector map, incl. target existence) | |
| run: npm test | |
| - name: Build search index (Pagefind) | |
| run: npm run pagefind | |
| - name: Upload Pages artifact | |
| if: github.ref == 'refs/heads/main' | |
| uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 | |
| with: | |
| path: public | |
| deploy: | |
| # Only main deploys; PRs validate the build only. | |
| if: github.ref == 'refs/heads/main' | |
| needs: build | |
| runs-on: ubuntu-latest | |
| # One concurrent Pages deploy, never cancelled mid-publish. This job only | |
| # runs on main, so the constant group serialises deploys without touching | |
| # PR builds. | |
| concurrency: | |
| group: pages | |
| cancel-in-progress: false | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 |