build-and-deploy.yml

name: Build and deploy
on:
  push:
    branches:
      - master
  schedule:
    # Three off-hour slots to dodge GHA's top-of-hour scheduling congestion.
    # GHA silently drops scheduled runs when load is high (no notification, no
    # retry); off-hour minutes (:17, :43, :23) hit a fraction of the load that
    # :00 does. Morning has two slots ahead of the 10am ET social-post fire
    # so a future-dated blog goes live before its social goes out.
    # Primary morning rebuild — 7:17 AM Eastern
    - cron: '17 11 * * *'
    # Fallback morning rebuild — 8:43 AM Eastern (86 min after primary)
    - cron: '43 12 * * *'
    # Afternoon rebuild for hour-granular dates — 4:23 PM Eastern
    - cron: '23 20 * * *'
  workflow_dispatch: null
  # Allows manual triggering of the workflow
permissions:
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout
jobs:
  buildSite:
    env:
      GOPATH: ${{ github.workspace }}/go
    name: Install deps and build site
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v3

      - uses: actions/checkout@v7
        with:
          # Full history (not the default shallow fetch-depth: 1) so Hugo's
          # enableGitInfo can read each file's last commit date. Without this,
          # .Lastmod falls back to build time and every page (and sitemap entry)
          # reports "Updated <today>".
          fetch-depth: 0
          # Blobless clone: fetch the full commit graph and trees enableGitInfo
          # needs, but skip downloading historical file blobs (the asset-heavy
          # history of a docs repo). Current-tree blobs are fetched on demand.
          filter: blob:none

      - uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          cache: 'yarn'
          cache-dependency-path: |
            yarn.lock
            infrastructure/yarn.lock
            theme/yarn.lock
            theme/stencil/yarn.lock

      - uses: actions/setup-go@v7
        with:
          go-version: 1.26.x

      - uses: peaceiris/actions-hugo@v3
        with:
          hugo-version: '0.157.0'
          extended: true

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::388588623842:role/ContinuousDelivery
          role-session-name: docs-deploy
          role-duration-seconds: 7200
          aws-region: us-west-2

      - name: Install s5cmd v2.3.0 for fast S3 uploads
        run: |
          S5CMD_VERSION="2.3.0"
          S5CMD_SHA256="de0fdbfa3aceae55e069ba81a0fc17b2026567637603734a387b2fca06c299b4"
          curl -fsSL -o /tmp/s5cmd.tar.gz "https://github.com/peak/s5cmd/releases/download/v${S5CMD_VERSION}/s5cmd_${S5CMD_VERSION}_Linux-64bit.tar.gz"
          echo "${S5CMD_SHA256}  /tmp/s5cmd.tar.gz" | sha256sum -c -
          sudo tar -xz -C /usr/local/bin s5cmd -f /tmp/s5cmd.tar.gz
          rm /tmp/s5cmd.tar.gz

      - name: Install Vale (required by scripts/ensure.sh)
        run: |
          VALE_VERSION="3.14.1"
          VALE_SHA256="ff2b49ffaa9dcd246fd5008f03ff67746d2790b75bf4d3657e2fb9530fb96db3"
          curl -fsSL -o /tmp/vale.tar.gz "https://github.com/errata-ai/vale/releases/download/v${VALE_VERSION}/vale_${VALE_VERSION}_Linux_64-bit.tar.gz"
          echo "${VALE_SHA256}  /tmp/vale.tar.gz" | sha256sum -c -
          sudo tar -xz -C /usr/local/bin vale -f /tmp/vale.tar.gz
          rm /tmp/vale.tar.gz

      - name: Install Pulumi CLI
        uses: pulumi/actions@v7

      # Restore previously generated OpenGraph cards so the build-time generator
      # only re-renders pages that changed (manifest content-hash skip). The
      # cards are gitignored; this cache is their only persistence across runs.
      - name: Cache generated meta images
        uses: actions/cache@v6
        with:
          path: assets/images/generated
          key: meta-images-${{ github.sha }}
          restore-keys: |
            meta-images-

      # Persist Hugo's processed-image cache (resources/_gen). Blog templates
      # process feature images to WebP at several sizes via .Process; without
      # this cache every CI run re-encodes ~2,400 images from scratch (~4-5
      # minutes of the build). With a warm cache, .Process is a lookup.
      - name: Cache Hugo processed images
        uses: actions/cache@v6
        with:
          path: resources
          # The version prefix must match the hugo-version pinned above, and be
          # identical in every workflow that caches resources/ -- pull-request.yml,
          # build-and-deploy.yml, testing-build-and-deploy.yml, and
          # pulumi-cli-docs.yml -- or they stop sharing a cache. Hugo does not put
          # its own version in the cache key, so without this a Hugo upgrade keeps
          # serving images encoded by the previous version indefinitely. Bump them
          # together on upgrade.
          key: hugo-resources-0.157.0-${{ github.sha }}
          restore-keys: |
            hugo-resources-0.157.0-

      - name: Record build start time
        run: |
          # Clear any stale queue-wait record so it can't mask a slow build on a
          # reused workspace; await-in-progress.js rewrites it during the build.
          rm -f "${CI_BUILD_QUEUE_WAIT_FILE:-.build-queue-wait-seconds}"
          echo "CI_BUILD_START_EPOCH=$(date +%s)" >> "$GITHUB_ENV"

      - name: Build and deploy
        run: make ci_push
        env:
          CDN_PULUMI_URN: ${{ vars.CDN_PULUMI_URN }}
          PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
          PULUMI_STACK_NAME: ${{ vars.PULUMI_STACK_NAME }}
          DEPLOYMENT_ENVIRONMENT: ${{ vars.DEPLOYMENT_ENVIRONMENT }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ALGOLIA_APP_ID: ${{ vars.ALGOLIA_APP_ID }}
          ALGOLIA_APP_SEARCH_KEY: ${{ vars.ALGOLIA_APP_SEARCH_KEY }}
          ALGOLIA_APP_ADMIN_KEY: ${{  steps.esc-secrets.outputs.ALGOLIA_APP_ADMIN_KEY }}
          NODE_OPTIONS: "--max_old_space_size=8192"

      # Duration guardrail: the July 2026 regression sat unnoticed for three
      # weeks because nothing watched build time. Warn in Slack when a
      # successful build runs long so the next regression is caught in days.
      # Time the step spends queued behind earlier runs of this workflow is
      # subtracted before the comparison; see the script's header comment.
      - name: Alert on slow build
        if: success()
        env:
          SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
          BUILD_DURATION_THRESHOLD_MINUTES: '20'
        run: ./scripts/ci-build-duration-alert.sh

      - name: Archive test results
        uses: actions/upload-artifact@v7
        with:
          name: browser-test-results
          path: cypress/videos

      - name: Archive bucket metadata
        uses: actions/upload-artifact@v7
        with:
          name: origin-bucket-metadata
          path: origin-bucket-metadata.json
  notify:
    if: (github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.event.pull_request.user.login == 'pulumi-bot')) && failure()
    name: Send slack notification
    runs-on: ubuntu-latest
    needs: [buildSite]
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v3
      - name: Slack Notification
        uses: docker://sholung/action-slack-notify:v2.3.0
        env:
          SLACK_CHANNEL: docs-ops
          SLACK_COLOR: "#F54242"
          SLACK_MESSAGE: "build and deploy failure in pulumi/docs repo :meow_sad:"
          SLACK_USERNAME: docsbot
          SLACK_WEBHOOK: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
          SLACK_ICON: https://www.pulumi.com/logos/brand/avatar-on-white.png
env:
  ESC_ACTION_OIDC_AUTH: true
  ESC_ACTION_OIDC_ORGANIZATION: pulumi
  ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
  ESC_ACTION_ENVIRONMENT: github-secrets/pulumi-docs
  ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false