Skip to content

Commit 2f99ed4

Browse files
NataliaIvakinaNataliaIvakina
authored
Update GHA for 4.4 (#350)
* Update workflows (#347) * Update workflows * Update reference to Traversal Framework * Apply suggestion from @NataliaIvakina * Fix the xref
1 parent 7de82ae commit 2f99ed4

7 files changed

Lines changed: 250 additions & 49 deletions

File tree

‎.github/workflows/docs-deploy-surge.yml‎

Lines changed: 104 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -10,25 +10,47 @@
1010

1111
name: "Deploy docs preview"
1212

13+
permissions:
14+
actions: read
15+
contents: read
16+
pull-requests: write
17+
1318
on:
1419
workflow_run:
1520
workflows: ["Verify docs PR"]
1621
types:
1722
- completed
1823

1924
jobs:
20-
publish-docs:
21-
# Uncomment this if statement to deploy only when the PR builds cleanly
22-
# if: github.event.workflow_run.conclusion == 'success'
25+
# [Optional] Restrict automatic dpeloyment to PRs from the upstream repo
26+
# For fork PRs, requires manual approval via the "preview" environment.
27+
# For PRs from the main repository this job is skipped and deploy-docs runs immediately.
28+
# Setup: create a "preview" environment in Settings → Environments with required reviewers.
29+
# approve-fork:
30+
# if: github.event.workflow_run.head_repository.full_name != github.repository
31+
# environment: preview
32+
# runs-on: ubuntu-latest
33+
# steps:
34+
# - name: Fork PR approved for deployment
35+
# run: echo "Approved"
36+
37+
deploy-docs:
38+
# needs: [approve-fork]
39+
# Run when approve-fork succeeded (fork, approved) or was skipped (non-fork).
40+
# Uncomment the conclusion check to deploy only when the PR builds cleanly:
41+
# && github.event.workflow_run.conclusion == 'success'
42+
# if: |
43+
# always() &&
44+
# (needs.approve-fork.result == 'success' || needs.approve-fork.result == 'skipped')
2345

2446
runs-on: ubuntu-latest
2547

2648
steps:
2749
- name: "Download built documentation"
28-
uses: actions/github-script@v7
50+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
2951
env:
3052
RUN_ID: ${{ github.event.workflow_run.id }}
31-
WORKSPACE: ${{ github.workspace }}
53+
ARTIFACT_DIR: ${{ runner.temp }}/artifacts
3254
with:
3355
script: |
3456
var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -47,7 +69,8 @@ jobs:
4769
archive_format: 'zip',
4870
});
4971
var fs = require('fs');
50-
fs.writeFileSync('${{ env.WORKSPACE }}/docs.zip', Buffer.from(downloadDocs.data));
72+
fs.mkdirSync(process.env.ARTIFACT_DIR + '/docs', { recursive: true });
73+
fs.writeFileSync(process.env.ARTIFACT_DIR + '/docs/docs.zip', Buffer.from(downloadDocs.data));
5174
5275
var matchArtifactChangelog = artifacts.data.artifacts.filter((artifact) => {
5376
return artifact.name == "changelog"
@@ -58,27 +81,68 @@ jobs:
5881
artifact_id: matchArtifactChangelog.id,
5982
archive_format: 'zip',
6083
});
61-
fs.writeFileSync('${{ env.WORKSPACE }}/changelog.zip', Buffer.from(downloadChangelog.data));
84+
fs.mkdirSync(process.env.ARTIFACT_DIR + '/changelog', { recursive: true });
85+
fs.writeFileSync(process.env.ARTIFACT_DIR + '/changelog/changelog.zip', Buffer.from(downloadChangelog.data));
86+
87+
- id: suspicious-path-check
88+
name: Suspicious paths check
89+
env:
90+
ARTIFACT_DIR: ${{ runner.temp }}/artifacts/docs
91+
run: |
92+
cd "$ARTIFACT_DIR"
93+
if unzip -l docs.zip | grep -q "\.\./"; then
94+
exit 1
95+
fi
96+
97+
- id: hidden-files-check
98+
name: Hidden files check
99+
env:
100+
ARTIFACT_DIR: ${{ runner.temp }}/artifacts/docs
101+
run: |
102+
cd "$ARTIFACT_DIR"
103+
HIDDEN_FILES=$(find . -type f -name ".*" | wc -l)
104+
if [ "$HIDDEN_FILES" -ne 0 ]; then
105+
echo "Security Alert: Unexpected hidden files detected!"
106+
exit 1
107+
fi
62108
63109
- id: unzip-docs
64-
run: unzip docs.zip
110+
name: Unzip docs artifact
111+
env:
112+
ARTIFACT_DIR: ${{ runner.temp }}/artifacts/docs
113+
run: |
114+
cd "$ARTIFACT_DIR"
115+
unzip docs.zip
65116
66-
- id: get-top-dir
117+
- id: find-changelog
118+
name: Get changelog
67119
run: |
68-
root=$(ls -d */index.html | sed -r 's/(.*)\/index\.html/\1/')
69-
echo "top-dir=$root" >> $GITHUB_OUTPUT
120+
if [ -f "${{ runner.temp }}/artifacts/changelog/changelog.zip" ]; then
121+
echo "has-changelog=true" >> $GITHUB_OUTPUT
122+
else
123+
echo "has-changelog=false" >> $GITHUB_OUTPUT
124+
fi
70125
71126
- id: unzip-changelog
72-
if: ${{ hashFiles('changelog.zip') != '' }}
73-
run: unzip changelog.zip
127+
name: Unzip changelog artifact
128+
if: ${{ steps.find-changelog.outputs.has-changelog == 'true' }}
129+
env:
130+
ARTIFACT_DIR: ${{ runner.temp }}/artifacts/changelog
131+
run: |
132+
cd "$ARTIFACT_DIR"
133+
unzip changelog.zip
74134
75135
- id: get-deploy-id
136+
name: Get deploy ID
137+
env:
138+
ARTIFACT_DIR: ${{ runner.temp }}/artifacts/docs
76139
run: |
77-
deployid=$(<deployid)
140+
deployid=$(<"$ARTIFACT_DIR/deployid")
78141
case "$deployid" in ''|*[!0-9]*) echo "Provided PR number is not an integer"; exit 1 ;; esac
79142
echo "deploy-id=$deployid" >> "$GITHUB_OUTPUT"
80143
81144
- id: get-deploy-url
145+
name: Get deploy URL
82146
env:
83147
ORG: ${{ github.event.repository.owner.login }}
84148
REPO: ${{ github.event.repository.name }}
@@ -87,38 +151,53 @@ jobs:
87151
deployurl=$ORG-$REPO-$DEPLOYID.surge.sh
88152
echo "deploy-url=$deployurl" >> $GITHUB_OUTPUT
89153
90-
- uses: actions/setup-node@v4
154+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
91155
with:
92156
node-version: lts/*
157+
158+
- id: prepare-deploy-dir
159+
name: Prepare deploy directory
160+
shell: bash
161+
env:
162+
DOCS_SRC_DIR: ${{ runner.temp }}/artifacts/docs
163+
DOCS_DEPLOY_DIR: ${{ runner.temp }}/deploy-docs
164+
run: |
165+
mkdir -p "$DOCS_DEPLOY_DIR"
166+
# Copy only the built docs into a clean directory for deployment
167+
cp -R "$DOCS_SRC_DIR"/. "$DOCS_DEPLOY_DIR"/
93168
94-
- name: Deploy docs to surge
169+
- id: surge-deploy
170+
name: Deploy docs to surge
95171
shell: bash
96172
env:
97173
DEPLOY_URL: ${{ steps.get-deploy-url.outputs.deploy-url }}
98174
SURGE_TOKEN: "${{ secrets.DOCS_SURGE_TOKEN }}"
99-
SITE_DIR: ${{ steps.get-top-dir.outputs.top-dir }}
175+
DEPLOY_DIR: ${{ runner.temp }}/deploy-docs
100176
run: |
101177
npm install -g surge
102-
surge ./$SITE_DIR $DEPLOY_URL --token "$SURGE_TOKEN"
178+
cd "$DEPLOY_DIR"
179+
surge . "$DEPLOY_URL" --token "$SURGE_TOKEN"
103180
104181
# If the PR artifacts include a changelog file, add it to the PR as a comment
105182
# The changelog contains links to new and changed files in the deployed docs
106-
- name: Comment on PR (changelog)
107-
if: ${{ hashFiles('changelog') != '' }}
108-
uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 #v2.9.0
183+
- id: comment-changelog
184+
name: Prepare changelog comment
185+
if: ${{ steps.find-changelog.outputs.has-changelog == 'true' }}
186+
uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 #v3
109187
with:
110188
number: ${{ steps.get-deploy-id.outputs.deploy-id }}
111189
recreate: true
112190
header: docs-pr-changes
113-
path: changelog
191+
path: ${{ runner.temp }}/artifacts/changelog/changelog
114192
GITHUB_TOKEN: ${{ secrets.DOCS_PR_COMMENT_TOKEN }}
115193

116194
# If there's no changelog, add a generic comment to the PR
117-
- name: Comment on PR (no changelog)
118-
if: ${{ hashFiles('changelog') == '' }}
195+
- id: comment-no-changelog
196+
name: Comment on PR (no changelog)
197+
if: ${{ steps.find-changelog.outputs.has-changelog == 'false' }}
119198
env:
120199
DEPLOY_URL: ${{ steps.get-deploy-url.outputs.deploy-url }}
121-
uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 #v2.9.0
200+
uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 #v3
122201
with:
123202
number: ${{ steps.get-deploy-id.outputs.deploy-id }}
124203
header: docs-pr-changes

‎.github/workflows/docs-generate-html.yml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
2+
name: "Generate HTML"
3+
4+
# edit the list of branches according to your repository
5+
# the list of branches should contain all the branches in your Antora publish playbooks
6+
on:
7+
push:
8+
branches:
9+
- "main"
10+
- "dev"
11+
- "5.x"
12+
- "4.4"
13+
workflow_dispatch:
14+
15+
# change `dev` and `main` according to your repository's branch names
16+
# `dev` is the branch you use to build and publish to staging
17+
# `main` is the branch you use to build and publish to neo4j.com/docs
18+
# in some cases, PROD_BRANCH and DEV_BRANCH may be the same branch
19+
env:
20+
DEV_BRANCH: 'dev'
21+
PROD_BRANCH: 'main'
22+
23+
jobs:
24+
25+
prepare-ref-env:
26+
name: Set build branch and environments
27+
runs-on: ubuntu-latest
28+
outputs:
29+
build-ref: ${{ steps.set-ref-env.outputs.build-ref }}
30+
environments: ${{ steps.set-ref-env.outputs.environments }}
31+
steps:
32+
- name: Set Build Ref
33+
id: set-ref-env
34+
run: |
35+
if [[ "${GITHUB_REF}" == "refs/heads/${{ env.DEV_BRANCH }}" ]]; then
36+
build_from=${{ env.DEV_BRANCH }}
37+
environments='["dev"]'
38+
else
39+
build_from=${{ env.PROD_BRANCH }}
40+
environments='["prod"]'
41+
fi
42+
# if dev branch = prod branch publish to both
43+
if [[ "${{ env.DEV_BRANCH }}" == "${{ env.PROD_BRANCH }}" ]]; then
44+
environments='["dev","prod"]'
45+
fi
46+
echo "build-ref=${build_from}" >> $GITHUB_OUTPUT
47+
echo "environments=${environments[@]}" >> $GITHUB_OUTPUT
48+
49+
docs-build:
50+
name: Generate HTML
51+
needs: prepare-ref-env
52+
uses: neo4j/docs-tools/.github/workflows/reusable-docs-build.yml@v2
53+
with:
54+
package-script: 'verify:publish'
55+
build-ref: ${{needs.prepare-ref-env.outputs.build-ref}}
56+
fetch-depth: 0
57+
58+
docs-verify:
59+
name: Verify HTML
60+
needs: docs-build
61+
uses: neo4j/docs-tools/.github/workflows/reusable-docs-verify.yml@v2
62+
with:
63+
failOnWarnings: true
64+
65+
publish-html:
66+
name: Publish HTML
67+
needs: [docs-verify, prepare-ref-env]
68+
runs-on: ubuntu-latest
69+
70+
strategy:
71+
matrix:
72+
environments: ${{ fromJson(needs.prepare-ref-env.outputs.environments) }}
73+
74+
steps:
75+
- name: Publish to ${{ matrix.environments }}
76+
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 #v4
77+
with:
78+
token: ${{ secrets.DOCS_DISPATCH_TOKEN }}
79+
repository: neo4j/docs-publish
80+
event-type: publish-html
81+
client-payload: |-
82+
{
83+
"org": "${{ github.repository_owner }}",
84+
"repo": "${{ github.event.repository.name }}",
85+
"run_id": "${{ github.run_id }}",
86+
"publish_env": "${{ matrix.environments }}"
87+
}
88+
89+
- name: Echo
90+
if: ${{ matrix.environments == 'prod' }}
91+
run: |
92+
echo "If this step runs then approval has been granted" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/docs-pr-checks.yml‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,22 @@
1-
21
name: "Verify docs PR"
32

3+
permissions:
4+
contents: read
5+
pull-requests: read
6+
47
on:
58
pull_request:
69
branches:
7-
- "main"
8-
- "dev"
9-
- "5.x"
10-
- "4.4"
10+
- "main"
11+
- "dev"
12+
- "5.x"
13+
- "4.4"
1114

1215
jobs:
1316

1417
# Generate HTML
1518
docs-build-pr:
16-
uses: neo4j/docs-tools/.github/workflows/reusable-docs-build.yml@v1.2.0
19+
uses: neo4j/docs-tools/.github/workflows/reusable-docs-build.yml@v2
1720
with:
1821
deploy-id: ${{ github.event.number }}
1922
retain-artifacts: 14
@@ -23,7 +26,7 @@ jobs:
2326
# By default, the job fails if there are errors, passes if there are warnings only.
2427
docs-verify-pr:
2528
needs: docs-build-pr
26-
uses: neo4j/docs-tools/.github/workflows/reusable-docs-verify.yml@v1.2.0
29+
uses: neo4j/docs-tools/.github/workflows/reusable-docs-verify.yml@v2
2730
with:
2831
failOnWarnings: true
2932

@@ -40,22 +43,22 @@ jobs:
4043
steps:
4144
- name: Get file changes
4245
id: get-file-changes
43-
uses: tj-actions/changed-files@2f7c5bfce28377bc069a65ba478de0a74aa0ca32 # v46.0.1
46+
uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47
4447
with:
4548
separator: ','
4649
files_yaml: |
4750
pages:
48-
- modules/**/pages/**/*.adoc
51+
- '**/modules/**/pages/**/*.adoc'
4952
asciidoc:
50-
- modules/**/*.adoc
53+
- '**/modules/**/*.adoc'
5154
5255
# Generate a PR comment if the docs are using the pageList extension
5356
# The extension maps asciidoc source files to their HTML output paths
5457
# The comment will contain links to new and changed pages in the deployed HTML docs
5558
docs-updates-comment-pr:
5659
if: needs.docs-build-pr.outputs.pages-listed == 'success'
5760
needs: [docs-build-pr, docs-changes-pr]
58-
uses: neo4j/docs-tools/.github/workflows/reusable-docs-pr-changes.yml@v1.2.0
61+
uses: neo4j/docs-tools/.github/workflows/reusable-docs-pr-changes.yml@v2
5962
with:
6063
pages-modified: ${{ needs.docs-changes-pr.outputs.pages-modified }}
6164
pages-added: ${{ needs.docs-changes-pr.outputs.pages-added }}

‎.github/workflows/docs-teardown.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
# copy this workflow into your repo
22
name: "Documentation Teardown"
33

4+
permissions:
5+
contents: read
6+
pull-requests: write
7+
48
on:
59
pull_request_target:
610
branches:
711
- "main"
812
- "dev"
913
- "5.x"
1014
- "4.4"
15+
1116
types:
1217
- closed
1318

@@ -16,7 +21,7 @@ jobs:
1621
runs-on: ubuntu-latest
1722

1823
steps:
19-
- uses: actions/setup-node@v4
24+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #v6
2025
with:
2126
node-version: lts/*
2227

@@ -39,7 +44,7 @@ jobs:
3944
surge teardown $DEPLOY_URL --token "$SURGE_TOKEN"
4045
4146
- name: Comment on PR
42-
uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 #v2.9.0
47+
uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 #v3
4348
with:
4449
number: ${{ github.event.pull_request.number }}
4550
header: docs-pr-changes

0 commit comments

Comments
 (0)