ci: move signing secrets to build step, cache only on main #204
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Novella Site | |
| on: | |
| push: | |
| branches: ["main"] | |
| paths: | |
| - "apps/site/**" | |
| - "README.md" | |
| - "assets/screenshots_*.PNG" | |
| - "package.json" | |
| - "package-lock.json" | |
| - "tsconfig.base.json" | |
| - ".github/workflows/deploy_site.yml" | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 3 * * *" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: novella-site | |
| cancel-in-progress: true | |
| jobs: | |
| build-and-deploy: | |
| name: Cloudflare Pages | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| # release 事件默认 checkout tag 的代码，需固定 main 保证部署的是最新网站。 | |
| ref: main | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build site | |
| # 仅此步骤需要 GitHub token（fetch-site-data 拉取 releases/latest）。 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_REPOSITORY: ${{ github.repository }} | |
| SITE_URL: ${{ vars.SITE_URL || 'https://novella.celia.sh' }} | |
| run: npm run build --workspace @novella/site | |
| - name: Deploy to Cloudflare Pages | |
| uses: cloudflare/wrangler-action@v4 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| wranglerVersion: "4" | |
| command: pages deploy apps/site/dist --project-name=${{ vars.CF_PAGES_PROJECT_NAME || 'novella' }} |