deploy.yml

name: Deploy to GitHub Pages

# Production deploy is gated on publishing a GitHub release.
# Build verification on PRs / main pushes lives in ci.yml.
on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read
  pages: write
  id-token: write

concurrency:
  group: 'pages'
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: .bun-version

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build website
        run: bun run build

      - name: Build summary
        if: always()
        run: |
          bun_version=$(bun --version 2>/dev/null || echo n/a)
          node_version=$(node --version 2>/dev/null || echo n/a)
          astro_version=$(node -p "require('astro/package.json').version" 2>/dev/null || echo n/a)
          pages_built=0
          [ -d dist ] && pages_built=$(find dist -name '*.html' | wc -l | tr -d ' ')
          {
            echo "## 🏗️ Build — \`${{ job.status }}\`"
            echo ""
            echo "| Item | Value |"
            echo "| --- | --- |"
            echo "| Bun | $bun_version |"
            echo "| Node | $node_version |"
            echo "| Astro | $astro_version |"
            echo "| Pages built | $pages_built |"
            echo "| Commit | \`${GITHUB_SHA::7}\` |"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload artifact
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: ./dist
          # Without this the action tars ./dist with --exclude=.[^/]*, which drops
          # public/.well-known/ - the domain verification files served from there
          # (Flathub, security.txt) would 404 in production.
          include-hidden-files: true

  deploy:
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

      - name: Deploy summary
        if: always()
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          PAGE_URL: ${{ steps.deployment.outputs.page_url }}
        run: |
          {
            echo "## 🚀 Production deploy — \`${{ job.status }}\`"
            echo ""
            echo "| Item | Value |"
            echo "| --- | --- |"
            echo "| Release | ${RELEASE_TAG:-_manual dispatch_} |"
            echo "| Site URL | ${PAGE_URL:-n/a} |"
            echo "| Commit | \`${GITHUB_SHA::7}\` |"
          } >> "$GITHUB_STEP_SUMMARY"