Repository navigation
Archive website (LFS + history cleanup) #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Archive website (pax + gzip + signify) | |
| on: | |
| schedule: | |
| - cron: '0 0 * * *' # Once per day at 00:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| jobs: | |
| archive: | |
| runs-on: ubuntu-latest | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| SIGNIFY_KEY: ${{ secrets.SIGNIFY_KEY }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y signify-openbsd | |
| - name: Create Archive, Checksum, and Signature | |
| run: | | |
| set -e | |
| echo "Running on:" | |
| uname -a | |
| REPO_NAME=$(basename "$GITHUB_REPOSITORY") | |
| ARCHIVE_DIR=archive | |
| TMP_DIR=/tmp/archive | |
| ARCHIVE="$TMP_DIR/$REPO_NAME.tar.gz" | |
| CHECKSUM="$TMP_DIR/$REPO_NAME.tar.gz.sha256" | |
| SIGNATURE="$TMP_DIR/$REPO_NAME.tar.gz.sig" | |
| rm -f "$ARCHIVE" "$CHECKSUM" "$SIGNATURE" | |
| # Create tar.gz archive in PAX format | |
| tar --format=pax -cf - . | gzip -n -9 > "$ARCHIVE" | |
| # Generate SHA256 checksum | |
| sha256sum "$ARCHIVE" | awk '{print $1}' > "$CHECKSUM" | |
| # Write signify key (from secret, with untrusted comment) | |
| printf "untrusted comment: GitHub Actions archive key\n%s\n" "$SIGNIFY_KEY" > /tmp/archive.sec | |
| chmod 600 /tmp/archive.sec | |
| # Sign the archive | |
| signify-openbsd -S -s /tmp/archive.sec -m "$ARCHIVE" | |
| # Copy archive files to repo archive directory | |
| rsync -av --delete "$TMP_DIR/" "$ARCHIVE_DIR/" | |
| - name: Commit and Push Changes via GitHub CLI | |
| run: | | |
| set -e | |
| # Authenticate GitHub CLI | |
| echo "$GH_TOKEN" | gh auth login --with-token | |
| # Create a commit if changes exist | |
| if gh repo view --json defaultBranchRef | grep -q '"name": "main"'; then | |
| BRANCH="main" | |
| else | |
| BRANCH=$(gh repo view --json defaultBranchRef -q '.defaultBranchRef.name') | |
| fi | |
| gh repo clone "$GITHUB_REPOSITORY" temp-repo | |
| cd temp-repo | |
| rsync -av --delete ../archive/ archive/ | |
| gh auth setup-git | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| if [ -n "$(git status --porcelain)" ]; then | |
| git add archive/ | |
| git commit -m "Archive website [skip ci]" | |
| git push origin "$BRANCH" | |
| else | |
| echo "No changes to commit." | |
| fi |