ci: fail closed when Mermaid rendering fails, instead of shipping raw… #123
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update Preview PDF | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: {} | |
| concurrency: | |
| group: preview-pdf | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: Build and verify preview PDF | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| - name: Record source integrity | |
| run: echo "EXPECTED_README_SHA=$(sha256sum README.md | awk '{print $1}')" >> "$GITHUB_ENV" | |
| - name: Install Chromium and CJK fonts | |
| uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2 | |
| with: | |
| chrome-version: stable | |
| - name: Install CJK fonts and PDF inspection tools | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra poppler-utils | |
| - name: Install mdpress 0.7.10 in isolation | |
| env: | |
| MDPRESS_VERSION: "0.7.10" | |
| MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4" | |
| run: | | |
| archive="/tmp/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" | |
| extract_dir="$(mktemp -d)" | |
| curl -fsSL "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" -o "$archive" | |
| echo "${MDPRESS_SHA256} $archive" | sha256sum -c - | |
| tar --extract --gzip --file "$archive" --directory "$extract_dir" mdpress | |
| sudo install -m 0755 "$extract_dir/mdpress" /usr/local/bin/mdpress | |
| echo "${EXPECTED_README_SHA} README.md" | sha256sum -c - | |
| mdpress --version | |
| - name: Build latest preview PDF | |
| run: | | |
| mkdir -p dist | |
| mdpress build --format pdf --output dist/ai_beginner_guide.pdf | |
| - name: Verify preview PDF and checksum | |
| run: | | |
| python3 tools/verify_artifacts.py \ | |
| --readme README.md \ | |
| --expected-readme-sha "$EXPECTED_README_SHA" \ | |
| --pdf dist/ai_beginner_guide.pdf | |
| (cd dist && sha256sum ai_beginner_guide.pdf > SHA256SUMS) | |
| (cd dist && sha256sum -c SHA256SUMS) | |
| - name: Transfer verified preview artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ai_beginner_guide-preview | |
| path: | | |
| dist/ai_beginner_guide.pdf | |
| dist/SHA256SUMS | |
| if-no-files-found: error | |
| retention-days: 1 | |
| publish: | |
| name: Publish verified preview PDF | |
| needs: build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: write | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_REPO: ${{ github.repository }} | |
| steps: | |
| - name: Download verified preview artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: ai_beginner_guide-preview | |
| path: dist | |
| - name: Recheck transferred artifact checksums | |
| run: (cd dist && sha256sum -c SHA256SUMS) | |
| - name: Write release notes | |
| run: | | |
| cat > dist/release-notes.md <<EOF | |
| Auto-updated preview PDF from \`${GITHUB_SHA::7}\`. | |
| - Branch: \`${GITHUB_REF_NAME}\` | |
| - Commit: https://github.com/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA} | |
| - Run: https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID} | |
| EOF | |
| - name: Synchronize mutable preview tag | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [[ ! "$GITHUB_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then | |
| echo "Invalid GITHUB_REPOSITORY: $GITHUB_REPOSITORY" >&2 | |
| exit 1 | |
| fi | |
| if [[ ! "$GITHUB_SHA" =~ ^[0-9a-f]{40}$ ]]; then | |
| echo "Invalid GITHUB_SHA" >&2 | |
| exit 1 | |
| fi | |
| probe_dir=$(mktemp -d) | |
| trap 'rm -rf "$probe_dir"' EXIT | |
| set +e | |
| gh api --include --method GET \ | |
| "repos/${GITHUB_REPOSITORY}/git/ref/tags/preview-pdf" \ | |
| >"$probe_dir/response" 2>"$probe_dir/error" | |
| probe_rc=$? | |
| set -e | |
| http_status=$(awk '$1 ~ /^HTTP\// && $2 ~ /^[0-9][0-9][0-9]$/ { status=$2 } END { print status }' "$probe_dir/response") | |
| if [[ $probe_rc -eq 0 && "$http_status" == "200" ]]; then | |
| gh api --silent --method PATCH \ | |
| "repos/${GITHUB_REPOSITORY}/git/refs/tags/preview-pdf" \ | |
| --raw-field sha="$GITHUB_SHA" \ | |
| --field force=true | |
| elif [[ $probe_rc -ne 0 && "$http_status" == "404" ]]; then | |
| gh api --silent --method POST \ | |
| "repos/${GITHUB_REPOSITORY}/git/refs" \ | |
| --raw-field ref="refs/tags/preview-pdf" \ | |
| --raw-field sha="$GITHUB_SHA" | |
| else | |
| cat "$probe_dir/response" >&2 | |
| cat "$probe_dir/error" >&2 | |
| echo "Preview tag lookup failed (exit=$probe_rc, HTTP=${http_status:-unavailable}); refusing to mutate refs or releases." >&2 | |
| exit 1 | |
| fi | |
| - name: Create or update preview release | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| error_file=$(mktemp) | |
| trap 'rm -f "$error_file"' EXIT | |
| set +e | |
| gh release view preview-pdf >/dev/null 2>"$error_file" | |
| release_rc=$? | |
| set -e | |
| if [[ $release_rc -eq 0 ]]; then | |
| gh release edit preview-pdf \ | |
| --title "Latest Preview PDF" \ | |
| --notes-file dist/release-notes.md \ | |
| --prerelease | |
| elif [[ "$(tr -d '\r' < "$error_file")" == "release not found" ]]; then | |
| gh release create preview-pdf \ | |
| --title "Latest Preview PDF" \ | |
| --notes-file dist/release-notes.md \ | |
| --prerelease \ | |
| --latest=false \ | |
| --verify-tag | |
| else | |
| cat "$error_file" >&2 | |
| echo "Preview release lookup failed (exit=$release_rc); refusing to create or edit the release." >&2 | |
| exit 1 | |
| fi | |
| - name: Remove legacy preview asset | |
| run: gh release delete-asset preview-pdf latest.pdf -y || true | |
| - name: Upload verified preview artifacts | |
| run: gh release upload preview-pdf dist/ai_beginner_guide.pdf dist/SHA256SUMS --clobber |