diff options
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/deploy.yml | 94 |
1 files changed, 94 insertions, 0 deletions
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml new file mode 100644 index 0000000..fd1587e --- /dev/null +++ b/.github/workflows/deploy.yml @@ -0,0 +1,94 @@ +name: Deploy legacy snapshot worker +on: + workflow_dispatch: + inputs: + promote: + description: "false = candidate only; true = promote to production worker" + type: boolean + default: false + force_pdf_refresh: + description: "true = re-fetch + re-upload the 1.3 PDF even if it already exists in R2" + type: boolean + default: false +permissions: + contents: read +# Never cancel a mid-flight deploy — queue behind it instead (fleet parity). +concurrency: + group: legacy-deploy + cancel-in-progress: false +jobs: + deploy: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: { persist-credentials: false } + - uses: actions/checkout@v4 + with: { repository: vyos/vyos-documentation, ref: rolling, path: docsrepo, persist-credentials: false } + - uses: actions/setup-node@v4 + with: { node-version: 22 } + # Runs BEFORE the Worker deploy (fail fast): if the PDF can't be fetched, validated, + # and secured in R2, no Worker goes live — otherwise a promote=true run could leave + # production serving HTML whose legacy-PDF link 404s, violating the spec §5 site+PDF + # consistency invariant the main pipeline enforces. + - name: Upload legacy 1.3 PDF to R2 (apex §5 fallback source) + env: + CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN_DOCS }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} + run: | + set -eu + cd docsrepo/workers && npm ci # the Deploy step's own npm ci re-run is a fast no-op + + R2_KEY="vyos-docs-artifacts/legacy/1.3/vyos-documentation.pdf" + # 1.2/1.3 are frozen (spec §15a) — once the PDF is seeded in R2 it never + # changes, and after RTD sunsets, docs.vyos.io/_/downloads/... is gone, so + # re-dispatching this workflow must not depend on re-fetching it. Probe + # existence first (wrangler r2 has no head-only verb; `get --pipe` is the + # cheapest existence check the CLI exposes) and skip fetch+upload on a hit. + if [ '${{ inputs.force_pdf_refresh }}' != 'true' ] && \ + npx wrangler r2 object get "$R2_KEY" --remote --pipe >/dev/null 2>/tmp/r2-probe.log; then + echo "PDF already present at $R2_KEY — skipping fetch+upload (force_pdf_refresh=false)" + exit 0 + fi + + # r2-staging/ (tools/snapshot.sh's local output) is gitignored, so CI re-fetches + # from the pre-sunset RTD source directly. Browser-UA + retry added defensively: + # tools/snapshot.sh's wget mirror crawl needed a browser UA to pass Cloudflare's + # managed challenge, while its own PDF curl needed neither locally — but CI's + # IP/request pattern differs, so both guards are cheap insurance here. + # 29.2 MiB > the 25 MiB Worker per-asset cap, so this artifact never lands in + # the deploy's dist/assets/ below — it goes straight to the shared + # vyos-docs-artifacts R2 bucket the apex Worker's DOCS_PDFS binding reads + # (workers/apex/wrangler.jsonc in vyos-documentation, both envs). + curl -fL --retry 5 --retry-delay 5 \ + --user-agent "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0 Safari/537.36" \ + "https://docs.vyos.io/_/downloads/en/1.3/pdf/" -o /tmp/vyos-documentation-1.3.pdf + + size=$(stat -c%s /tmp/vyos-documentation-1.3.pdf) + min=$((25*1024*1024)); max=$((35*1024*1024)) + if [ "$size" -le "$min" ] || [ "$size" -ge "$max" ]; then + echo "PDF size sanity check FAILED: got $size bytes, expected strictly between $min and $max bytes (25-35 MiB)" + exit 1 + fi + echo "PDF size OK: $size bytes" + + header=$(head -c 5 /tmp/vyos-documentation-1.3.pdf) + if [ "$header" != "%PDF-" ]; then + echo "PDF content validation FAILED: file does not start with %PDF- (got: $header)" + exit 1 + fi + echo "PDF content OK: %PDF- header present" + + npx wrangler r2 object put "$R2_KEY" \ + --file /tmp/vyos-documentation-1.3.pdf --remote + - name: Deploy + env: + CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN_DOCS }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} + run: | + set -eu + mkdir -p docsrepo/dist/assets && cp -r snapshot/. docsrepo/dist/assets/ + cd docsrepo/workers && npm ci + name="vyos-docs-legacy$( [ '${{ inputs.promote }}' = 'true' ] || echo '-candidate' )" + envv="$( [ '${{ inputs.promote }}' = 'true' ] && echo production || echo canary )" + npx wrangler deploy --config branch/wrangler.legacy.jsonc \ + --name "$name" --var DOCS_BUILD_SHA:'${{ github.sha }}' --var DOCS_ENV:"$envv" |