Repository navigation
Archive website (LFS + history cleanup) #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Archive website (pax + gzip + signify) | |
| on: | |
| schedule: | |
| - cron: '0 0 * * *' # Once per day at 00:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| jobs: | |
| archive: | |
| runs-on: ubuntu-latest | |
| env: | |
| GH_TOKEN: ${{ secrets.GH_TOKEN }} | |
| SIGNIFY_KEY: ${{ github.repository }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y pax signify-openbsd rsync | |
| - name: Create Archive, Checksum, and Signature | |
| run: | | |
| set -e | |
| echo "Running on:" | |
| uname -a | |
| # Repo info | |
| REPO_NAME=$(basename "$GITHUB_REPOSITORY") | |
| ARCHIVE_DIR=archive | |
| TMP_DIR=/tmp/archive | |
| mkdir -p "$TMP_DIR" "$ARCHIVE_DIR" | |
| ARCHIVE="$TMP_DIR/$REPO_NAME.tar.gz" | |
| CHECKSUM="$TMP_DIR/$REPO_NAME.tar.gz.sha256" | |
| SIGNATURE="$TMP_DIR/$REPO_NAME.tar.gz.sig" | |
| rm -f "$ARCHIVE" "$CHECKSUM" "$SIGNATURE" | |
| # Create tar.gz archive | |
| pax -w . | gzip -n -9 > "$ARCHIVE" | |
| # Generate SHA256 checksum | |
| sha256sum "$ARCHIVE" | awk '{print $1}' > "$CHECKSUM" | |
| # Write signify key (no passphrase) | |
| printf "%s\n" "$SIGNIFY_KEY" > /tmp/archive.sec | |
| chmod 600 /tmp/archive.sec | |
| # Sign the archive | |
| signify-openbsd -S -s /tmp/archive.sec -m "$ARCHIVE" | |
| # Replace archive directory contents | |
| rsync -av --delete "$TMP_DIR/" "$ARCHIVE_DIR/" | |
| - name: Commit and Push Changes | |
| run: | | |
| set -e | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add archive/ | |
| git commit -m "Archive website [skip ci]" || exit 0 | |
| # Authenticate with GitHub CLI | |
| echo "$GH_TOKEN" | gh auth login --with-token | |
| git push origin main |