Repository navigation
Create 111.md #67
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| # dispatched by auto-merge after a robot merge: GITHUB_TOKEN pushes do | |
| # not fire `push` events (recursion guard), but workflow_dispatch does. | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| # logins that skip the strict per-PR profile rules (maintainers with | |
| # maintain/admin permission are skipped automatically, too) | |
| PROFILE_BYPASS: hnrobert | |
| jobs: | |
| check-profiles: | |
| name: Check profiles/ | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.12" | |
| - name: Collect the PR's changed files | |
| if: github.event_name == 'pull_request' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh api "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" \ | |
| --paginate --jq '.[] | [.status, .filename] | @tsv' > pr-files.tsv | |
| cat pr-files.tsv | |
| # Strict rules (exactly one file, named after the PR author) apply | |
| # only to PRs from docs/* (first-time add) or fix/* (update your | |
| # own profile) branches, never to bypassed logins or maintain/admin | |
| # collaborators. | |
| - name: Decide whether the strict profile rules apply | |
| id: scope | |
| if: github.event_name == 'pull_request' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| run: | | |
| branch="${{ github.event.pull_request.head.ref }}" | |
| bypass=no | |
| for user in $PROFILE_BYPASS; do | |
| [ "$user" = "$PR_AUTHOR" ] && bypass=yes | |
| done | |
| if [ "$bypass" = no ]; then | |
| perm=$(gh api "repos/${{ github.repository }}/collaborators/$PR_AUTHOR/permission" \ | |
| --jq .permission 2>/dev/null || echo none) | |
| case "$perm" in maintain|admin) bypass=yes ;; esac | |
| fi | |
| strict=no; mode="" | |
| if [ "$bypass" = no ]; then | |
| case "$branch" in | |
| docs/*) strict=yes; mode=added ;; | |
| fix/*) strict=yes; mode=modified ;; | |
| esac | |
| fi | |
| echo "strict=$strict" >> "$GITHUB_OUTPUT" | |
| echo "mode=$mode" >> "$GITHUB_OUTPUT" | |
| echo "branch=$branch author=$PR_AUTHOR bypass=$bypass strict=$strict mode=$mode" | |
| - name: Run the profiles check | |
| env: | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| run: | | |
| if [ "${{ steps.scope.outputs.strict }}" = yes ] && [ -f pr-files.tsv ]; then | |
| python scripts/check_profiles.py \ | |
| --author "${PR_AUTHOR}" \ | |
| --pr-files pr-files.tsv \ | |
| --expect "${{ steps.scope.outputs.mode }}" | |
| else | |
| python scripts/check_profiles.py | |
| fi | |
| publish-site: | |
| name: Build and deploy the roster site | |
| needs: check-profiles | |
| if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pages: write | |
| id-token: write | |
| actions: write | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.12" | |
| - name: Generate the roster page | |
| run: python scripts/build_site.py | |
| # Re-runs keep artifacts from earlier attempts, and deploy-pages | |
| # refuses when it finds more than one "github-pages" artifact in a | |
| # run — so drop any leftovers before uploading a fresh one. | |
| - name: Drop stale github-pages artifacts from this run | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \ | |
| --jq '.artifacts[] | select(.name == "github-pages") | .id' \ | |
| | while read -r id; do | |
| echo "deleting stale artifact $id" | |
| gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id" | |
| done || true | |
| # Deploy https://comppsyunion.github.io/github-playground/ straight | |
| # from the workflow (Pages source: GitHub Actions). The freshly | |
| # built docs/ directory is uploaded as the artifact — nothing is | |
| # ever committed back to the repository. | |
| - uses: actions/configure-pages@v6 | |
| - uses: actions/upload-pages-artifact@v5 | |
| with: | |
| path: docs | |
| - id: deployment | |
| uses: actions/deploy-pages@v5 |