compass/.github/workflows/eng-docs-deploy.yml at main · RigelBuild/compass · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
# Continuous deployment for the Compass engineering docsite (apps/eng-docs).
#
# A push to main deploys production; a pull_request deploys a per-PR Cloudflare
# Pages preview and upserts the preview-URL comment (apps/eng-docs/scripts/
# deploy.ts, RIG-1765). This is a STANDALONE CD workflow — it is deliberately
# NOT part of `moon ci :ci` (the CI gate in ci.yml), so a deploy failure never
# gates a merge and a green CI never waits on Cloudflare.
name: eng-docs

on:
  push:
    branches: [main]
  pull_request: {}

permissions:
  contents: read
  pull-requests: write

# Same toolchain contract as the devenv shell: moon runs the nix tools on PATH,
# never a ~/.proto shim, even if a runner image ever ships one.
env:
  MOON_TOOLCHAIN_FORCE_GLOBALS: 'true'

concurrency:
  group: eng-docs-deploy-${{ github.ref }}
  cancel-in-progress: true

jobs:
  deploy:
    name: deploy
    runs-on: ubuntu-latest
    # Fork guard: a push always runs; a PR only runs when it comes from a branch
    # in THIS repo. Fork PRs get no secrets (CLOUDFLARE_*/GH_TOKEN), so a deploy
    # would fail anyway — and running one with an attacker's code near secret
    # plumbing is the risk this closes. Same-repo PRs are trusted.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # moon's affected-graph diffing (compass-eng-docs:build depends on the
          # gather inputs) resolves its base against `main`; a shallow single-ref
          # PR checkout has no such ref, so the build's `git ... main` aborts
          # (exit 128). Full history populates refs/remotes/origin/*, matching
          # ci.yml's checkout (ci.yml:130-135).
          fetch-depth: 0

      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
        with:
          # The docsite build runs under moon, whose toolchain (bun/node/moon)
          # comes from nix, not `setup-*` actions — the same posture ci.yml
          # takes. Flakes + nix-command are needed to evaluate and build the
          # gate-tools derivations below.
          #
          # The substituters are declared here rather than via
          # `accept-flake-config = true`, which would make nix trust the
          # `nixConfig` of any flake it evaluates (the RigelBuild/devenv flake carries
          # such a block) — a PR could then add its own substituter and trusted
          # key and CI would run binaries signed by it. Naming the two caches the
          # repo legitimately uses keeps that trust in a reviewed file. Mirrors
          # ci.yml's install-nix-action step.
          extra_nix_config: |
            experimental-features = nix-command flakes
            extra-substituters = https://devenv.cachix.org https://cachix.cachix.org
            extra-trusted-public-keys = devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw= cachix.cachix.org-1:eWNHQldwUO7G2VkjpnjDbWwy4KQ/HNxht7H4SSoMckM=

      - name: Put the language toolchains on PATH
        # The language runtimes (bun/node/moon/go) come from nix, not `setup-*`
        # actions: gate-tools.nix's `langs` output resolves the identical
        # derivations the dev shell does, so this job runs the pinned versions
        # byte-for-byte. `langs` is a closed set, so it needs no `--arg attrs`.
        # Mirrors ci.yml's "Put the language toolchains on PATH" step.
        run: |
          stores=$(nix eval --json -f tools/toolchain/gate-tools.nix langs \
            | jq -r '.[].store')
          # Fail closed locally rather than leaning on the absence of a
          # root-level flake.nix: with no installables `nix build` would build a
          # default package if one existed, so an empty `langs` must error here.
          [ -n "$stores" ] || {
            echo "::error::gate-tools.nix langs produced no store paths"
            exit 1
          }
          nix build --no-link $stores
          for store in $stores; do
            echo "$store/bin" >>"$GITHUB_PATH"
          done

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build the docsite
        run: moon run compass-eng-docs:build

      - name: Deploy to Cloudflare Pages
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        working-directory: apps/eng-docs
        run: bun scripts/deploy.ts