fix: anchor extension badges inside signed-section, not the viewport #10
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| build: | |
| name: Build Site | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Setup Hugo | |
| uses: peaceiris/actions-hugo@v3 | |
| with: | |
| hugo-version: "0.161.1" | |
| extended: true | |
| - name: Setup Go | |
| # Required by Hugo Modules to fetch the Hugo Blox theme on first build. | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.22" | |
| - name: Setup Node.js | |
| # Hugo Blox needs preact + tailwindcss + pagefind at build time. | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22" | |
| - name: Install npm deps | |
| run: npm install | |
| - name: Build site | |
| # node_modules/.bin must be on PATH so the tailwindcss CLI resolves. | |
| run: | | |
| export PATH="$PWD/node_modules/.bin:$PATH" | |
| hugo --minify | |
| - name: Build search index | |
| run: npx pagefind --site public | |
| - name: Verify placeholder signed-sections exist | |
| # Hugo emits <signed-section> placeholders with data-htmltrust-placeholder | |
| # markers on every page that opts in via `htmltrust.sign: true` front-matter. | |
| # The signer (next step) will replace them with real content-hash / signature | |
| # / keyid / algorithm attributes. Six content pages currently opt in: | |
| # /spec/, /architecture/, /implementation/, /use-cases/, /faq/, | |
| # /blog/paper-published/. | |
| run: | | |
| count=$(grep -rl '<signed-section' public/ | wc -l) | |
| echo "Found $count pages with <signed-section> placeholders" | |
| if [ "$count" -lt 6 ]; then | |
| echo "ERROR: Expected at least 6 pages with signed-section placeholders" | |
| exit 1 | |
| fi | |
| - name: Install htmltrust-sign | |
| run: go install github.com/HTMLTrust/htmltrust-hugo/cmd/htmltrust-sign@latest | |
| - name: Sign content | |
| env: | |
| HTMLTRUST_SIGNING_KEY: ${{ secrets.HTMLTRUST_SIGNING_KEY }} | |
| run: | | |
| htmltrust-sign \ | |
| --dir public \ | |
| --keyid did:web:jason-grey.com \ | |
| --domain www.htmltrust.org \ | |
| -v | |
| - name: Verify signed sections are complete | |
| run: | | |
| if grep -rq 'data-htmltrust-placeholder' public/; then | |
| echo "ERROR: placeholder markers remain - signer did not run on all sections" | |
| exit 1 | |
| fi | |
| for f in $(grep -rl '<signed-section' public/); do | |
| case "$f" in *.html) ;; *) continue ;; esac | |
| grep -q 'content-hash="sha256:' "$f" || { echo "MISSING content-hash in $f"; exit 1; } | |
| grep -q 'signature="' "$f" || { echo "MISSING signature in $f"; exit 1; } | |
| grep -q 'keyid="did:web:' "$f" || { echo "MISSING keyid in $f"; exit 1; } | |
| grep -q 'algorithm="ed25519"' "$f" || { echo "MISSING algorithm in $f"; exit 1; } | |
| done | |
| echo "OK: all signed-section elements carry the four spec-required attributes" | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: website | |
| path: public/ | |
| deploy: | |
| name: Deploy to Cloudflare Pages | |
| runs-on: ubuntu-latest | |
| needs: build | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: website | |
| path: public/ | |
| - name: Deploy to Cloudflare Pages | |
| uses: cloudflare/wrangler-action@v4 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| command: pages deploy public --project-name=htmltrust-website |