openscreen/.github/workflows/docs.yml at main · getopenscreen/openscreen · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
name: Docs

on:
  pull_request:
    branches: [main]
    paths:
      - "website/**"
      - ".github/workflows/docs.yml"
  push:
    branches: [main]
    paths:
      - "website/**"
      - ".github/workflows/docs.yml"
  # The /download page resolves the current release's assets at build time so it
  # can link each platform to its actual file. Without a post-release rebuild that
  # data would freeze at whatever the last website/** change saw, and the page
  # would keep serving the previous version's binaries after every release.
  #
  # That rebuild is a `workflow_dispatch` fired by build.yml once the release is
  # published, NOT an `on: release` trigger. A release event runs with
  # github.ref = refs/tags/vX.Y.Z, and the deploy environment only allows `main`
  # to deploy, so the deploy job failed on every stable release (it never
  # surfaced earlier because pre-releases skipped the build entirely). Dispatching
  # against main both satisfies that policy and publishes main's docs rather than
  # the release branch's older snapshot.
  workflow_dispatch:

# Cancel in-flight runs on the same ref so fast follow-up pushes
# don't queue stale builds.
concurrency:
  group: docs-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    name: Build site
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          # Full history. The sitemap's <lastmod> is read from `git log` per
          # file, and the default depth-1 clone gives every file the deployed
          # commit's date — all sixteen dated URLs carried the same day.
          fetch-depth: 0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: website/package-lock.json
      - name: Install dependencies
        working-directory: website
        run: npm ci
      - name: Type-check
        working-directory: website
        run: npm run typecheck
      - name: Unit tests
        working-directory: website
        run: npm test
      # Warnings only: an English edit should not block a deploy, and the list
      # says what to hand a translator (website/i18n/TRANSLATING.md). Needs the
      # full history the checkout fetches.
      - name: Translation freshness
        working-directory: website
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: npm run i18n:check
      # The walkthrough's clips and stills are committed to this repo, which has
      # no LFS filter — their size is permanent, so a budget that lives only in a
      # design note drifts on the first re-cut. This also fails any clip encoded
      # with an audio track, which iOS Safari refuses to autoplay without a
      # gesture even when the element is muted.
      - name: Check media budget
        working-directory: website
        run: npm run check:media
      # The demo loops are served from R2 (media.getopenscreen.com), not git, so
      # nothing above would notice a loop a page names that was never uploaded,
      # or a cut folder holding the wrong files. media/loops.json records what
      # scripts/media/publish-loops.mjs uploaded; this holds the code to it and
      # asks the CDN for every recorded file, paced under the zone's rate limit.
      - name: Check demo loops
        working-directory: website
        run: npm run check:loops -- --live
      - name: Check responsive backgrounds
        working-directory: website
        run: npm run check:backgrounds -- --live
      # The recreation's data is generated from the app's own source and a
      # vendored project document. It is committed, so it can go stale in either
      # direction — a locale key moves, a timeline constant changes — and the
      # page would then be showing numbers the application no longer produces.
      # The generator compares its own output byte for byte, which is why the
      # formatter is told to leave that one file alone (biome.json).
      - name: Check recreation data
        working-directory: website
        run: npm run check:recreation
      # The config reads the star count and the latest release from the GitHub
      # API once per build. Unauthenticated, that is the runner IP's 60-an-hour
      # quota; the workflow token lifts it, with the read-only contents
      # permission this job already has.
      - name: Build
        working-directory: website
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: npm run build
      # The rspack-minimizers plugin in docusaurus.config.ts edits options that
      # Rspack keeps privately, so an Rspack update can make it a silent no-op:
      # the license files disappear and range media queries come back, and the
      # build still passes. `if` rather than `! grep`, which `bash -e` ignores
      # unless it is the last command.
      - name: Check minifier output
        working-directory: website/build
        run: |
          ls assets/js/main.*.js.LICENSE.txt
          if grep -qE '\((width|height)[<>]' assets/css/*.css */assets/css/*.css; then
            echo "Range media syntax in CSS: the rspack-minimizers plugin no longer applies."
            exit 1
          fi
      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: website-build
          path: website/build
          retention-days: 7
          # Off by default since v4. Nothing in website/build is hidden today,
          # but a `.well-known/` for domain verification or security.txt is the
          # realistic case, and it would vanish from the deploy silently.
          include-hidden-files: true

  # The site is a Cloudflare Worker with static assets only (website/wrangler.jsonc).
  # The token lives in the `website` environment, which only `main` may deploy
  # from, so neither a PR nor a dispatch on another branch can read it.
  deploy:
    name: Deploy to Cloudflare
    runs-on: ubuntu-latest
    needs: build
    if: >-
      (github.event_name == 'push' && github.ref == 'refs/heads/main')
      || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    environment:
      name: website
      url: https://getopenscreen.com
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: website/wrangler.jsonc
          sparse-checkout-cone-mode: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: website-build
          path: website/build
      - name: Deploy
        working-directory: website
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: npx --yes wrangler@4.145.0 deploy