Build digest #394
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build digest | |
| on: | |
| schedule: | |
| # Cible : 7h, 13h, 19h heure de Paris. GitHub Actions ne gère pas le DST | |
| # (cron toujours interprété en UTC), il faut donc choisir une saison. | |
| # On optimise pour l'heure d'été (UTC+2), la majorité de l'année : | |
| # 5,11,17 UTC = 7h, 13h, 19h Paris en été / 6h, 12h, 18h Paris en hiver | |
| # (donc 1h trop tôt l'hiver — compromis assumé). | |
| - cron: '0 5,11,17 * * *' | |
| workflow_dispatch: # bouton "Run workflow" manuel | |
| push: | |
| branches: [main] | |
| # On exclut les fichiers de doc pour ne pas re-générer un digest | |
| # à chaque modification de README/CHANGELOG/MEMORY. | |
| paths-ignore: | |
| - '**.md' | |
| - 'LICENSE' | |
| permissions: | |
| contents: write # commit seen/last_success/digest + déploiement Pages | |
| # Sérialise les runs : un run en cours bloque le suivant au lieu de tourner en | |
| # parallèle. Évite la collision au `git push` (deux runs poussant sur main → | |
| # `! [rejected] (fetch first)`). cancel-in-progress=false : on ne tue jamais un | |
| # run en train de committer, on met juste le suivant en file d'attente. | |
| concurrency: | |
| group: build-digest | |
| cancel-in-progress: false | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Setup Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.12' | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: pip install -r requirements.txt | |
| - name: Run collection guardrail tests | |
| run: python -m unittest discover -s tests -v | |
| - name: Run digest | |
| env: | |
| # Au moins une clé suffit. Le client (llm_client.py) initialise | |
| # uniquement le provider effectivement utilisé par FILTERING_MODEL | |
| # et SYNTHESIS_MODEL — l'autre clé peut donc être absente. | |
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | |
| OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} | |
| run: python digest.py | |
| - name: Upload detailed audit log | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: audit-details-${{ github.run_id }} | |
| path: logs/audit-details.md | |
| if-no-files-found: warn | |
| retention-days: 30 | |
| - name: Commit & push generated files | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add output/digest.xml seen.json last_success.json \ | |
| logs/audit-summary.md logs/audit-errors.md | |
| if git diff --staged --quiet; then | |
| echo "Rien à committer." | |
| exit 0 | |
| fi | |
| git commit -m "Update digest [skip ci]" | |
| # Resync avant push au cas où main a bougé entre-temps (défense en | |
| # profondeur — la sérialisation via concurrency: devrait déjà l'éviter). | |
| git pull --rebase --autostash origin main | |
| git push | |
| - name: Deploy to GitHub Pages | |
| uses: peaceiris/actions-gh-pages@v4 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| publish_dir: ./output | |
| publish_branch: gh-pages |