Pages delivery #249
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pages delivery | |
| on: | |
| workflow_run: | |
| workflows: | |
| - Client checks | |
| types: | |
| - completed | |
| permissions: | |
| contents: read | |
| jobs: | |
| identity: | |
| name: Resolve exact current-main delivery | |
| if: >- | |
| github.repository == 'InKCre/client-web' && | |
| github.event.workflow_run.conclusion == 'success' && | |
| github.event.workflow_run.event == 'push' && | |
| github.event.workflow_run.head_branch == 'main' && | |
| github.event.workflow_run.head_repository.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| outputs: | |
| source_sha: ${{ steps.identity.outputs.source_sha }} | |
| steps: | |
| - name: Resolve the protected-main source | |
| id: identity | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| env: | |
| SOURCE_SHA: ${{ github.event.workflow_run.head_sha }} | |
| with: | |
| script: | | |
| const currentMain = await github.rest.git.getRef({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| ref: 'heads/main', | |
| }) | |
| if (currentMain.data.object.sha !== process.env.SOURCE_SHA) { | |
| core.setFailed('A newer main revision superseded this delivery run.') | |
| return | |
| } | |
| core.setOutput('source_sha', process.env.SOURCE_SHA) | |
| deliver: | |
| name: Build and deploy exact Pages release | |
| needs: identity | |
| concurrency: | |
| group: pages-main | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| deployments: write | |
| packages: read | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 25 | |
| environment: | |
| name: production | |
| url: https://app.inkcre.dev | |
| steps: | |
| - name: Checkout the exact current-main source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ needs.identity.outputs.source_sha }} | |
| path: release | |
| fetch-depth: 2 | |
| persist-credentials: false | |
| - name: Install the pinned pnpm release | |
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| with: | |
| version: 11.11.0 | |
| - name: Set up Node | |
| uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version-file: release/package.json | |
| cache: pnpm | |
| cache-dependency-path: release/pnpm-lock.yaml | |
| registry-url: https://npm.pkg.github.com | |
| scope: '@inkcre' | |
| - name: Install the frozen release workspace | |
| working-directory: release | |
| run: pnpm install --frozen-lockfile | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build the exact-main release | |
| working-directory: release | |
| run: pnpm build | |
| - name: Reverify main before Pages delivery | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| env: | |
| SOURCE_SHA: ${{ needs.identity.outputs.source_sha }} | |
| with: | |
| script: | | |
| const currentMain = await github.rest.git.getRef({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| ref: 'heads/main', | |
| }) | |
| if (currentMain.data.object.sha !== process.env.SOURCE_SHA) { | |
| core.setFailed('Main changed after the release build; refusing Pages delivery.') | |
| } | |
| - name: Deploy to Cloudflare Pages | |
| id: pages | |
| uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| packageManager: pnpm | |
| wranglerVersion: 4.114.0 | |
| workingDirectory: release | |
| command: >- | |
| pages deploy apps/client-web/dist | |
| --project-name=${{ vars.CLOUDFLARE_PAGES_PROJECT }} | |
| --branch=main | |
| --commit-hash=${{ needs.identity.outputs.source_sha }} | |
| --commit-dirty=false | |
| - name: Smoke-test Pages and app.inkcre.dev | |
| run: node release/scripts/verify-pages-deployment.mjs | |
| env: | |
| CLOUDFLARE_PAGES_DEPLOYMENT_ID: ${{ steps.pages.outputs.pages-deployment-id }} | |
| CLOUDFLARE_PAGES_DEPLOYMENT_URL: ${{ steps.pages.outputs.deployment-url }} | |
| INKCRE_CLIENT_WEB_ORIGIN: https://app.inkcre.dev |