ci: bump the github-actions group across 1 directory with 7 updates (… #289
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Simple workflow for deploying static content to GitHub Pages | |
| name: Deploy static content to Pages | |
| on: | |
| # Only deploy when the landing page (or this workflow) actually changes — | |
| # not on every commit to main. `assets/` is the marketing site that gets | |
| # published to Pages; the rest of the repo (the app) doesn't affect it. | |
| # `mix.exs` IS included: a release commit bumps the version there, and | |
| # the Sync step below pulls that version into the landing page at deploy | |
| # time, so chore(release) commits need to re-deploy too. | |
| push: | |
| branches: ["main"] | |
| paths: | |
| - "assets/**" | |
| - ".github/workflows/static.yml" | |
| - "mix.exs" | |
| # Allows you to run this workflow manually from the Actions tab | |
| workflow_dispatch: | |
| # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. | |
| # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. | |
| concurrency: | |
| group: "pages" | |
| cancel-in-progress: false | |
| jobs: | |
| # Single deploy job since we're just deploying | |
| deploy: | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup Pages | |
| uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 | |
| # Single source of truth for the version is `mix.exs`. Substitute | |
| # whatever `v\d+\.\d+\.\d+` shape sits in the committed landing | |
| # page so the deployed page can never drift behind a release. | |
| # `mix.exs` is a tracked file in our own repo — no event-data | |
| # interpolation, no injection vector. | |
| - name: Sync landing-page version from mix.exs | |
| run: | | |
| set -euo pipefail | |
| VERSION=$(sed -nE 's/.*version: *"([0-9]+\.[0-9]+\.[0-9]+)".*/\1/p' mix.exs | head -1) | |
| if [ -z "$VERSION" ]; then | |
| echo "::error::could not read version from mix.exs" | |
| exit 1 | |
| fi | |
| echo "Substituting v$VERSION into assets/index.html" | |
| sed -i -E "s/v[0-9]+\.[0-9]+\.[0-9]+/v$VERSION/g" assets/index.html | |
| # Assert the substitution actually landed — guards against future | |
| # edits that drop the version literal from the landing page (which | |
| # would leave the deploy with stale data we couldn't otherwise | |
| # detect). `grep -c` exits 0 even with 0 matches and just prints | |
| # the count. | |
| MATCHES=$(grep -cE "v$VERSION" assets/index.html || true) | |
| echo "Found $MATCHES v$VERSION mentions in assets/index.html" | |
| if [ "$MATCHES" -lt 1 ]; then | |
| echo "::error::landing-page sync produced 0 v$VERSION mentions — refusing to deploy stale page" | |
| exit 1 | |
| fi | |
| - name: Upload artifact | |
| # v4.0.0 — v3.0.1 internally used a bare `actions/upload-artifact@v4`, | |
| # which the repo's "require SHA-pinned actions" ruleset rejects | |
| # transitively; v4.0.0 SHA-pins that nested ref (to upload-artifact | |
| # v4.6.2, the same SHA used elsewhere in CI). | |
| uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 | |
| with: | |
| path: 'assets/' | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 |