Files
openmlsys-zh/.github/workflows/update_docs.yml
Chivier Humber c48d3cb394 ci: deploy docs with an SSH deploy key instead of a PAT
The DEPLOY_TOKEN personal access token expired, so pushing to
openmlsys.github.io failed with "Invalid username or token". Use a
write-enabled deploy key scoped to that repository (DEPLOY_KEY secret),
which does not expire and is not tied to a personal account. GitHub's
SSH host key is pinned instead of trusting ssh-keyscan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-26 02:14:12 +00:00

82 lines
2.8 KiB
YAML

name: Deploy Docs
on:
push:
branches: [main]
workflow_dispatch:
jobs:
deploy:
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v4
- name: Set up Python 3.10
uses: actions/setup-python@v5
with:
python-version: '3.10'
- name: Setup mdBook
uses: peaceiris/actions-mdbook@v2
with:
mdbook-version: 'latest'
- name: Run mdBook regression tests
run: |
python3 -m unittest discover -s tests -p 'test_prepare_mdbook.py'
python3 -m unittest discover -s tests -p 'test_prepare_mdbook_zh.py'
python3 -m unittest discover -s tests -p 'test_assemble_docs_publish_tree.py'
python3 -m unittest discover -s tests -p 'test_ensure_book_resources.py'
python3 -m unittest discover -s tests -p 'test_image_references.py'
- name: Build v2 (EN + ZH) with mdBook
run: bash build_mdbook_v2.sh
- name: Build v1 (EN + ZH) with mdBook
run: bash build_mdbook_v1.sh
- name: Verify build outputs
run: |
for d in .mdbook-v2/book .mdbook-v2-zh/book .mdbook-v1/book .mdbook-v1-zh/book; do
if [ ! -f "$d/index.html" ]; then
echo "ERROR: $d/index.html not found"
exit 1
fi
echo "OK: $d/index.html exists"
done
- name: Assemble and deploy to openmlsys.github.io
env:
DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
run: |
# DEPLOY_KEY is the private half of a write-enabled deploy key on openmlsys.github.io.
key_file="${RUNNER_TEMP}/deploy_key"
known_hosts="${RUNNER_TEMP}/known_hosts"
printf '%s\n' "${DEPLOY_KEY}" > "${key_file}"
chmod 600 "${key_file}"
echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" > "${known_hosts}"
export GIT_SSH_COMMAND="ssh -i ${key_file} -o IdentitiesOnly=yes -o UserKnownHostsFile=${known_hosts} -o StrictHostKeyChecking=yes"
git clone git@github.com:openmlsys/openmlsys.github.io.git
python3 tools/assemble_docs_publish_tree.py \
--destination-root openmlsys.github.io \
--docs-subdir docs \
--v2-en-source .mdbook-v2/book \
--v2-zh-source .mdbook-v2-zh/book \
--v1-en-source .mdbook-v1/book \
--v1-zh-source .mdbook-v1-zh/book
cd openmlsys.github.io
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add docs
if git diff --cached --quiet; then
echo "No changes to commit"
else
git commit -m "deploy: update docs from ${GITHUB_REPOSITORY}@${GITHUB_SHA}"
git push
fi