gha/examples/quarto-publish.yml at main · Morrison-Lab/gha · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
# Copy to .github/workflows/quarto-publish.yml in your repo.
# NOTE: Do NOT name a `concurrency:` group `gh-pages` anywhere in this
# caller workflow -- neither a top-level block nor one on the calling job,
# which deadlock identically
# ([gha#811](https://github.com/Morrison-Lab/gha/pull/811)).
# Any OTHER group name is fine,
# and is how you serialize this workflow's own runs.
# The reusable workflow serializes gh-pages deploys internally
# on its `deploy` job (`group: gh-pages`).
# A caller-level block with the same group name deadlocks GitHub Actions
# against the nested job:
# the job fails with no runner, no steps, and no log, so the site silently
# stops publishing ([gha#809](https://github.com/Morrison-Lab/gha/issues/809)).
#
# Renders a Quarto site and deploys it to the gh-pages branch (which GitHub
# Pages serves). The calling job must grant contents: write so the deploy step
# can push to gh-pages (repos default to a read-only token).
#
# One-time repo setup: Settings -> Pages -> Build and deployment -> Source =
# "Deploy from a branch", branch `gh-pages` / `(root)`.
name: Quarto Publish

on:
  push:
    branches: [main]
  workflow_dispatch:
  # For a render-only build check (deploy: false below), also add:
  # pull_request:

# Serialize deploys so two pushes don't race on the gh-pages branch. Named
# for this workflow rather than `gh-pages`, which the called workflow's own
# deploy job already holds -- reusing that name deadlocks the two, per the
# NOTE at the top. `cancel-in-progress: false` so a half-written deploy
# finishes rather than being killed part-way.
concurrency:
  group: quarto-publish-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    permissions:
      # Push the rendered site to gh-pages. Grant this even with deploy: false
      # (render only): the workflow's deploy job declares contents: write, and a
      # reusable workflow's caller must grant a job's permissions even when that
      # job is skipped. The build job downscopes its own token to read.
      contents: write
    uses: Morrison-Lab/gha/.github/workflows/quarto-publish.yml@v2
    # with:
    #   path: website           # Quarto project lives in a subdir (default: repo root)
    #   setup-r: true           # for R/knitr Quarto projects (default: false)
    #   use-renv: true          # restore R deps with renv instead of r-packages
    #   install-package: true   # R CMD INSTALL <path> before render (for R packages)
    #   setup-chrome: true      # install Chrome for revealjs/screenshots/mermaid
    #   tinytex: true           # needed to render PDF outputs
    #   apt-packages: ''        # extra system packages (space-separated)
    #   output-dir: docs        # render to a dir other than the default _site (overrides _quarto.yml)
    #   render-profile: website # Quarto --profile to render with
    #   formats: 'pdf docx revealjs html' # per-format render split to prevent V8 OOM
    #   freeze-cache: true      # cache Quarto _freeze across runs
    #   deno-v8-options: '--max-old-space-size=12288,--max-heap-size=12288'
    #   fail-on-render-warning: true # fail if Quarto emits WARN in render log
    #   forbid-log-patterns: |  # fail on specific forbidden substrings in render log
    #     doesn't match any files or folders
    #   checkout-submodules: true
    #   pre-render-artifact: demo-media       # inject a prior job's artifact before render
    #   pre-render-artifact-path: website/media
    #   deploy: false           # render only (e.g. a build check); skips the gh-pages push
    #                           # (still grant contents: write — the deploy job is declared)
    # secrets:
    #   SUBMODULES_TOKEN: ${{ secrets.SUBMODULES_TOKEN }}