Library: the AI shelf is stocked without holding the request open, an… #234
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Deployment | |
| on: | |
| push: | |
| branches: | |
| - 'main' | |
| - 'dev' | |
| # One deployment per target at a time, queued in push order. Without this, | |
| # two merges within one CI window run in parallel and the slower build wins | |
| # the :prod / :staging tag, so the older commit can be rolled out last. | |
| concurrency: | |
| group: deploy-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Free disk space on runner | |
| uses: jlumbroso/free-disk-space@v1.3.1 | |
| with: | |
| tool-cache: false | |
| android: true | |
| dotnet: true | |
| haskell: true | |
| large-packages: false | |
| docker-images: true | |
| swap-storage: true | |
| - name: Checkout repository | |
| uses: actions/checkout@v2 | |
| - name: Set up release checks | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20.19.0' | |
| - name: Verify production CMS contract | |
| if: github.ref == 'refs/heads/main' | |
| run: node scripts/release/library-public-check.cjs prod | |
| - name: Verify staging CMS contract | |
| if: github.ref == 'refs/heads/dev' | |
| run: node scripts/release/library-public-check.cjs staging | |
| - name: Preserve release check journal | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: library-release-checks | |
| path: docs/release-audits/journal.jsonl | |
| if-no-files-found: ignore | |
| # No Docker layer cache on purpose. Measured on 2026-09-08 (runs | |
| # 34251421040 and 34254842825): restoring the 2.25 GB node_modules | |
| # layer from the Actions cache took 184s (136s download, 48s extract) | |
| # against 74s for a fresh yarn install, and populating it cost 411s | |
| # once. The builder and runner stages also carry .env files, so they | |
| # must never be exported. The image build exports no cache. | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: 'Login to GitHub Container Registry' | |
| run: echo ${{secrets.REGISTRY_PASSWORD}} | docker login ${{secrets.REGISTRY_HOST}} --username ${{secrets.REGISTRY_USERNAME}} --password-stdin | |
| - name: Copy production env file | |
| if: github.ref == 'refs/heads/main' | |
| run: | | |
| echo ${{ secrets.ENV_PRODUCTION }} | base64 -d > .env | |
| cp .env .env.staging | |
| - name: Copy staging env file | |
| if: github.ref == 'refs/heads/dev' | |
| run: | | |
| echo ${{ secrets.ENV_STAGING }} | base64 -d > .env.staging | |
| cp .env.staging .env | |
| - name: Production Deploy | |
| if: github.ref == 'refs/heads/main' | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ secrets.REGISTRY_HOST }}/keepsimple-next:prod | |
| - name: Staging Deploy | |
| if: github.ref == 'refs/heads/dev' | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ secrets.REGISTRY_HOST }}/keepsimple-next:staging |