homeracker

---
name: Deploy GitHub Pages

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: pages
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pages: write
      id-token: write
      # Listing and downloading the preview artifacts, and checking whether each one's PR
      # still qualifies. An explicit permissions block sets every scope it omits to none.
      actions: read
      pull-requests: read
    outputs:
      previews: ${{ steps.collect.outputs.previews }}
      meta: ${{ steps.collect.outputs.meta }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Configure Pages
        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

      - name: Build site
        uses: ./.github/actions/build-site

      # Every live preview is re-collected from scratch on each deployment, so a cancelled run
      # loses nothing and a preview that no longer qualifies is pruned here.
      - name: Collect PR previews
        id: collect
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          published=""
          : > meta.txt
          # Artifact ids do not increase with age, so the current upload per name is the newest by date.
          gh api --paginate "repos/$REPO/actions/artifacts" \
            --jq '.artifacts[] | select(.expired == false) | select(.name | startswith("preview-pr-")) | "\(.name) \(.id) \(.created_at) \(.workflow_run.head_sha)"' \
            | sort -k3,3r | awk '!seen[$1]++' > artifacts.txt
          while read -r name id built sha; do
            pr="${name#preview-pr-}"
            qualifies=$(gh pr view "$pr" --repo "$REPO" --json state,labels,files --jq '
              if .state != "OPEN" then "no"
              elif ([.files[].path] | any(startswith("site/") or startswith("configurator/"))) then "yes"
              elif ([.labels[].name] | index("deploy-preview")) then "yes"
              else "no" end' 2>/dev/null || echo "no")
            if [ "$qualifies" != "yes" ]; then
              echo "prune $name"
              continue
            fi
            echo "publish $name"
            curl -sSL -H "Authorization: Bearer $GH_TOKEN" -o "$name.zip" \
              "https://api.github.com/repos/$REPO/actions/artifacts/$id/zip"
            mkdir -p "site/dist/preview/pr-$pr"
            unzip -q "$name.zip" -d "site/dist/preview/pr-$pr"
            published="$published $pr"
            printf '%s %s %s\n' "$pr" "$built" "$sha" >> meta.txt
          done < artifacts.txt
          echo "previews=$(echo "$published" | xargs)" >> "$GITHUB_OUTPUT"
          echo "meta=$(jq -cRn '[inputs | split(" ") | {pr: .[0], built: .[1], sha: .[2]}]' < meta.txt)" >> "$GITHUB_OUTPUT"

      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: site/dist

  deploy:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

  comment:
    needs: [build, deploy]
    if: needs.build.outputs.previews != ''
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      # One comment per PR, edited in place, so a busy branch neither stacks up links nor
      # collects an edit history of identical bodies. Republishing an unchanged preview leaves
      # the build line alone, so an edit here means that preview really was rebuilt.
      - name: Post the preview links
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          PREVIEWS: ${{ needs.build.outputs.previews }}
          META: ${{ needs.build.outputs.meta }}
        run: |
          set -euo pipefail
          for pr in $PREVIEWS; do
            url="https://homeracker.org/preview/pr-$pr/"
            # Surfaces the live set on the run page, so a deployment says what it published.
            echo "::notice title=Preview pr-$pr::$url"
            built=$(jq -r --arg pr "$pr" '.[] | select(.pr == $pr) | .built' <<< "$META")
            sha=$(jq -r --arg pr "$pr" '.[] | select(.pr == $pr) | .sha' <<< "$META")
            body=$(printf '%s\n🔭 **Preview:** %s\n\nLast rebuilt %s from %s. Removed when this PR closes.' \
              '<!-- preview-url -->' "$url" "$(date -u -d "$built" '+%d.%m.%Y %H:%M UTC')" "${sha:0:7}")
            existing=$(gh api "repos/$REPO/issues/$pr/comments" \
              --jq 'map(select(.body | startswith("<!-- preview-url -->"))) | first | .id // empty')
            if [ -z "$existing" ]; then
              gh api -X POST "repos/$REPO/issues/$pr/comments" -f body="$body" --silent
            elif [ "$(gh api "repos/$REPO/issues/comments/$existing" --jq .body)" != "$body" ]; then
              gh api -X PATCH "repos/$REPO/issues/comments/$existing" -f body="$body" --silent
            fi
          done
...