perspecta/.github/workflows/pages.yml at master · timcogan/perspecta · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: Pages

on:
  push:
    branches:
      - master
    paths:
      - ".cargo/**"
      - "Cargo.lock"
      - "Cargo.toml"
      - "Makefile"
      - "build.rs"
      - "rust-toolchain*"
      - "src/**"
      - "scripts/**"
      - "website/**"
      - ".github/workflows/pages.yml"
  workflow_dispatch:

permissions: {}

concurrency:
  group: pages
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      PERSPECTA_WEB_SOURCE_COMMIT: ${{ github.sha }}
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          ref: ${{ github.sha }}

      - name: Verify master source
        shell: bash
        env:
          PERSPECTA_TRIGGER_REF: ${{ github.ref }}
          PERSPECTA_TRIGGER_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          if [[ "$PERSPECTA_TRIGGER_REF" != "refs/heads/master" ]]; then
            echo "Pages may only be deployed from master, got: $PERSPECTA_TRIGGER_REF" >&2
            exit 1
          fi
          actual_sha="$(git rev-parse --verify 'HEAD^{commit}')"
          if [[ "$actual_sha" != "$PERSPECTA_TRIGGER_SHA" ]]; then
            echo "Checked-out commit does not match the Pages trigger." >&2
            exit 1
          fi
          if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then
            echo "Pages checkout is unexpectedly dirty." >&2
            exit 1
          fi

      - name: Resolve Rust toolchain
        id: rust-toolchain
        shell: bash
        run: |
          set -euo pipefail
          toolchain="$(
            awk -F '"' '/^[[:space:]]*channel[[:space:]]*=[[:space:]]*"/ { print $2; exit }' rust-toolchain.toml
          )"
          if [[ -z "$toolchain" ]]; then
            echo "Could not determine the Rust toolchain from rust-toolchain.toml." >&2
            exit 1
          fi
          echo "toolchain=$toolchain" >> "$GITHUB_OUTPUT"

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
        with:
          toolchain: ${{ steps.rust-toolchain.outputs.toolchain }}
          targets: wasm32-unknown-unknown

      - name: Cache Rust build
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: pages-wasm

      - name: Install cargo-binstall
        uses: cargo-bins/cargo-binstall@75b4bfae1b2c753a6806bbce6e6cb89b602de33c # v1.22.0
        with:
          version: "1.21.1"

      - name: Install matching wasm-bindgen CLI
        shell: bash
        run: |
          set -euo pipefail
          version="$({ awk '
            /^\[\[package\]\]$/ { in_package = 0 }
            /^name = "wasm-bindgen"$/ { in_package = 1; next }
            in_package && /^version = / {
              gsub(/"/, "", $3)
              print $3
              exit
            }
          ' Cargo.lock; } || true)"
          if [[ -z "$version" ]]; then
            echo "Could not determine the wasm-bindgen version from Cargo.lock." >&2
            exit 1
          fi
          cargo binstall wasm-bindgen-cli --version "$version" --locked --force --no-confirm --disable-strategies compile
          wasm-bindgen --version

      - name: Setup Hugo
        uses: peaceiris/actions-hugo@v3
        with:
          hugo-version: "0.123.8"
          extended: false

      - name: Build web preview assets
        run: make web-assets

      - name: Build site
        run: make site-build

      - name: Verify Pages artifact
        run: make verify-web-pages

      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@v5
        with:
          path: website/public

  deploy:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v5