Nojoin/.github/workflows/site-deploy.yml at main · Valtora/Nojoin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
name: Site deploy

# The marketing site deploys on four triggers: a change under site/ landing on
# main, a published release (so the baked-in version and star count refresh),
# a weekly schedule (same reason, without needing a release), and by hand.
# There is deliberately no branch trigger: the workflow only ever deploys what
# main contains, so whatever lands there is what the public gets.
#
# That does NOT make reverting a complete rollback. Reverting an ordinary site/
# commit is fine, because the deploy just publishes the earlier content. But the
# route in site/wrangler.jsonc has nothing behind it any more — GitHub Pages was
# disabled and deleted when this site went live — so reverting the commit that
# added it takes www.nojoin.co.uk down instead of restoring it. Roll forward.
on:
  push:
    branches:
      - main
    paths:
      - "site/**"
  release:
    types: [published]
  schedule:
    # Monday 06:12 UTC. Off the hour to avoid the GitHub scheduled-job rush.
    - cron: "12 6 * * 1"
  workflow_dispatch:

permissions:
  contents: read

# One deploy at a time, and a queued deploy supersedes a waiting one. Never
# cancel a running deploy: wrangler uploads are not transactional enough to
# kill halfway through.
concurrency:
  group: site-deploy
  cancel-in-progress: false

jobs:
  deploy:
    name: Build and deploy
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "26"
          cache: npm
          cache-dependency-path: site/package-lock.json

      - name: Install site dependencies
        working-directory: site
        run: npm ci

      - name: Build the site
        working-directory: site
        # The token authenticates the build-time GitHub API calls (star count,
        # latest release) once site/src/data/github.ts exists; both values fall
        # back rather than failing the build, so this step must never depend on
        # api.github.com being reachable.
        #
        # PUBLIC_CF_BEACON_TOKEN is the Cloudflare Web Analytics siteTag. It is a
        # repository *variable*, not a secret: it grants nothing and is visible
        # in the markup of every deployed page. It lives here rather than in the
        # source so local builds and preview tunnels do not report into the live
        # figures. Unset is fine -- the beacon then does not render.
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PUBLIC_CF_BEACON_TOKEN: ${{ vars.CF_BEACON_TOKEN }}
        run: npm run build

      - name: Deploy to Cloudflare Workers
        working-directory: site
        # Uses the wrangler version pinned in site/package-lock.json rather
        # than a third-party deploy action.
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: npm exec --no -- wrangler deploy