Publish 2026-06-12T16:09:53Z from f687a93 #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # GitHub Pages workflow - Path A. | |
| # | |
| # Draft. Lives under .plans/deploy-modes/ until promoted to .github/workflows/pages.yml. | |
| # After promotion, enable Pages with source=GitHub Actions in repo Settings → Pages. | |
| # | |
| # Why a workflow instead of "Pages serves the branch root": | |
| # - Branch-source Pages publishes the entire repo, leaking worker/, .plans/, | |
| # node_modules/, etc. | |
| # - This workflow builds a clean artifact that matches the .assetsignore | |
| # exclusion list (same logical site the Worker bundles for Path B). | |
| # - Custom 404, future minify/sri/etc become possible without a build step today. | |
| # | |
| # Triggers: | |
| # - push to main: deploys. | |
| # - workflow_dispatch: manual one-off run from the Actions tab. | |
| # | |
| # Permissions (least privilege per job): | |
| # - build -> contents: read, pages: write (checkout + configure-pages) | |
| # - deploy -> pages: write, id-token: write (OIDC for actions/deploy-pages) | |
| # id-token: write is deliberately kept OFF the build job: that job runs deps, | |
| # tests and scripts, and must never be able to mint an OIDC token. | |
| name: Publish Pages | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: pages | |
| cancel-in-progress: false | |
| jobs: | |
| build: | |
| name: Build site artifact | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| pages: write | |
| # Default deploy mode is Pages. Gate via repo Actions variable DEPLOY_MODE: | |
| # unset or 'pages' -> this workflow runs | |
| # 'worker' -> this workflow is skipped, deploy.yml takes over | |
| if: vars.DEPLOY_MODE == '' || vars.DEPLOY_MODE == 'pages' | |
| steps: | |
| - name: Harden runner (audit egress) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Install deps | |
| run: bun install --frozen-lockfile | |
| - name: Build CSS | |
| run: bun run css | |
| - name: Build asset manifest | |
| run: bun run scripts/build-manifest.ts | |
| - name: Run tests | |
| run: bun test | |
| - name: Stage clean site root | |
| run: | | |
| set -euo pipefail | |
| mkdir -p _site | |
| rsync -a --delete \ | |
| --exclude 'tests/' \ | |
| --exclude 'scripts/' \ | |
| --exclude 'package.json' \ | |
| --exclude '.git/' \ | |
| --exclude '.github/' \ | |
| --exclude '.plans/' \ | |
| --exclude '.brainstorming/' \ | |
| --exclude '.backups/' \ | |
| --exclude '._docs/' \ | |
| --exclude '.wrangler/' \ | |
| --exclude 'worker/' \ | |
| --exclude 'node_modules/' \ | |
| --exclude 'demo/' \ | |
| --exclude 'bun.lock' \ | |
| --exclude 'Makefile' \ | |
| --exclude '.assetsignore' \ | |
| --exclude '.editorconfig' \ | |
| --exclude '.gitignore' \ | |
| --exclude 'TODO.md' \ | |
| --exclude '*.log' \ | |
| --exclude '.DS_Store' \ | |
| --exclude '**/.DS_Store' \ | |
| ./ _site/ | |
| - name: Verify entrypoint | |
| run: test -f _site/index.html | |
| - name: Configure Pages | |
| uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 | |
| - name: Upload artifact | |
| uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 | |
| with: | |
| path: _site | |
| deploy: | |
| name: Deploy to Pages | |
| needs: build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| pages: write | |
| id-token: write | |
| if: vars.DEPLOY_MODE == '' || vars.DEPLOY_MODE == 'pages' | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Deploy | |
| id: deployment | |
| uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 |