cli: edit --adf-file and comment --adf-file send a document as it is #902
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Deploy the zero-install hosted demo to GitHub Pages. | |
| # | |
| # Workflow is ready to run; Pages must be enabled once by a human: | |
| # Repo → Settings → Pages → Build and deployment → Source: GitHub Actions | |
| # | |
| # The published tree is rooted at the apex (GDK-676): / is a static landing | |
| # page, /demo/ the live demo, /backlog/ the public backlog. A project-path URL | |
| # such as https://<owner>.github.io/gadak/demo/ redirects to the custom domain | |
| # with the repo segment dropped, which is why the apps are not built for | |
| # /gadak/ any more. | |
| # | |
| # Only examples/demo.db + examples/attachments (already scrubbed public fixtures) | |
| # are baked into the artifact. Never point export-static at a personal mirror. | |
| name: Hosted demo (GitHub Pages) | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| concurrency: | |
| group: pages | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: Build hosted demo | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Set up Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - run: npm ci | |
| - name: Build binary | |
| run: CGO_ENABLED=0 go build -trimpath -o bin/gadak ./cmd/gadak | |
| - name: Build hosted demo (UI + static snapshot) | |
| env: | |
| # The Astro site below owns the apex now; keep the demo's static | |
| # door out of dist/hosted so the site's index.html survives. | |
| GADAK_LANDING: skip | |
| run: node tools/hosted-demo/build.mjs | |
| # The Astro site (site/) is the document root around the apps: / and | |
| # /install/ come from it, /demo/ and /backlog/ stay owned by the | |
| # hosted-demo build below. | |
| - name: Build apex site (Astro) | |
| run: | | |
| set -euo pipefail | |
| mkdir -p site/public && ln -sfn ../../docs/media site/public/media | |
| npm ci --prefix site | |
| npm run build --prefix site | |
| cp -R site/dist/. dist/hosted/ | |
| # The committed public backlog is one tar.gz; the viewer still | |
| # fetches detail/<KEY>.json, so the exploded tree must exist at deploy. | |
| # build.mjs unpacks too (local hosted-demo); this step is the Pages | |
| # source of truth and overwrites JSON onto the Vite backlog bundle. | |
| # The snapshot still carries a pre-GDK-676 /gadak/ apiBase; rewrite it | |
| # onto the runtime mount so hosted-fetch and config().apiBase agree. | |
| - name: Materialize public backlog snapshot | |
| run: | | |
| set -euo pipefail | |
| mkdir -p dist/hosted/backlog | |
| bash tools/backlog-snapshot.sh --unpack dist/hosted/backlog | |
| rm -f dist/hosted/backlog/MANIFEST | |
| node tools/hosted-demo/build.mjs --rewrite-backlog-config dist/hosted/backlog/config.json /backlog/ | |
| # GDK-52: the hosted browser gate runs in CI now, not only locally — a | |
| # false-state regression on the snapshot (feature entry points that 404) | |
| # must fail the build that would publish it. | |
| - name: Install Playwright chromium | |
| run: ./node_modules/.bin/playwright install --with-deps chromium | |
| - name: Hosted demo browser gate (GDK-52) | |
| run: ./node_modules/.bin/playwright test --config e2e/hosted/playwright.config.ts | |
| - name: Tenant-neutrality / secret scan | |
| run: | | |
| set -euo pipefail | |
| bash scripts/scan-internal.sh | |
| # The built artifact too: it is gitignored, so the pass above cannot | |
| # see it. Same scanner, not a second implementation — the inline grep | |
| # that used to be here was line-oriented and read a published issue | |
| # body that merely discusses "atlassian.net" as a concrete site URL | |
| # (2026-08-20). filter_disallowed_hosts matches hostnames. | |
| bash scripts/scan-internal.sh --dir dist/hosted | |
| # GDK-389: the public backlog is a whitelist-rebuilt snapshot. Assert the | |
| # structural invariants on the artifact that will actually be published. | |
| - name: Backlog scrub gate (GDK-389) | |
| run: | | |
| if [ -d dist/hosted/backlog ]; then | |
| bash tools/backlog-scrub-check.sh dist/hosted/backlog | |
| fi | |
| - name: Upload Pages artifact | |
| uses: actions/upload-pages-artifact@v3 | |
| with: | |
| path: dist/hosted | |
| deploy: | |
| name: Deploy to GitHub Pages | |
| needs: build | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Deploy | |
| id: deployment | |
| uses: actions/deploy-pages@v4 |