deploy.yml

name: Deploy to GitHub Pages

on:
  push:
    branches:
      - main
  workflow_dispatch:
  schedule:
    - cron: '17 * * * *'

permissions:
  contents: read

concurrency:
  group: public-docs-deploy
  cancel-in-progress: true

jobs:
  deploy:
    name: Deploy to GitHub Pages
    if: >-
      github.repository == 'durable-workflow/durable-workflow.github.io' &&
      github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          persist-credentials: false

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6
        with:
          node-version: 24
          cache: npm

      - name: Verify current public artifact tuple
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: node scripts/refresh-public-artifact-versions.js --check

      - name: Plan deployment
        id: deploy-plan
        env:
          DOCS_DEPLOY_EVENT_NAME: ${{ github.event_name }}
        run: node scripts/plan-docs-deploy.js

      - name: Resolve Workflow authority ref
        id: workflow-authority
        if: steps.deploy-plan.outputs.deploy == 'true'
        run: |
          node -e "process.stdout.write('ref=' + require('./scripts/public-artifact-versions.json').artifacts.workflow + '\n')" >> "$GITHUB_OUTPUT"

      - name: Checkout Workflow authority
        if: steps.deploy-plan.outputs.deploy == 'true'
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          repository: durable-workflow/workflow
          ref: ${{ steps.workflow-authority.outputs.ref }}
          path: .workflow-authority
          persist-credentials: false

      - name: Install dependencies
        if: steps.deploy-plan.outputs.deploy == 'true'
        run: npm ci

      - name: Verify pinned server protocol catalog
        if: steps.deploy-plan.outputs.deploy == 'true'
        env:
          PUBLIC_SERVER_PROTOCOL_CATALOG_EVIDENCE: public-server-protocol-catalog-conformance.json
        run: node scripts/check-public-server-protocol-catalog.js

      - name: Upload pinned server protocol catalog evidence
        if: ${{ always() && steps.deploy-plan.outputs.deploy == 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: public-server-protocol-catalog-conformance
          path: |
            public-server-protocol-catalog-conformance.json
            public-server-protocol-catalog-bootstrap.log
            public-server-protocol-catalog-server.log
          if-no-files-found: error

      - name: Build website
        if: steps.deploy-plan.outputs.deploy == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          WORKFLOW_SDK_NEUTRALITY_MANIFEST_PATH: ${{ github.workspace }}/.workflow-authority/resources/sdk-neutrality-contract.json
        run: npm run build

      - name: Verify public artifact tuple
        if: steps.deploy-plan.outputs.deploy == 'true'
        run: |
          node <<'NODE'
          const assert = require('assert');
          const fs = require('fs');

          const expected = require('./scripts/public-artifact-versions.json').artifacts;
          const audit = JSON.parse(fs.readFileSync('build/docs-page-release-audit.json', 'utf8'));
          const narrative = JSON.parse(fs.readFileSync('build/docs-narrative-audit.json', 'utf8'));
          const quickstart = JSON.parse(fs.readFileSync('build/quickstart-execution-contract.json', 'utf8'));

          for (const [name, version] of Object.entries(expected)) {
            assert.strictEqual(
              audit.artifact_versions && audit.artifact_versions[name],
              version,
              `docs-page-release-audit.json artifact_versions.${name}`
            );

            assert.strictEqual(
              quickstart.artifacts && quickstart.artifacts[name] && quickstart.artifacts[name].version,
              version,
              `quickstart-execution-contract.json artifacts.${name}.version`
            );

            assert.strictEqual(
              narrative.artifact_versions && narrative.artifact_versions[name],
              version,
              `docs-narrative-audit.json artifact_versions.${name}`
            );
          }

          assert.strictEqual(
            audit.release_status_guardrail &&
              audit.release_status_guardrail.stable_default_docs_version,
            '1.x',
            'release audit stable default docs version'
          );
          assert.strictEqual(
            quickstart.default_docs_guard &&
              quickstart.default_docs_guard.stable_default_docs_version,
            '1.x',
            'quickstart stable default docs version'
          );
          assert.strictEqual(
            narrative.release_status_guardrail &&
              narrative.release_status_guardrail.stable_default_docs_version,
            '1.x',
            'narrative audit stable default docs version'
          );
          assert.strictEqual(
            narrative.release_status_guardrail &&
              narrative.release_status_guardrail.explicit_prerelease_docs_version,
            '2.0',
            'narrative audit explicit prerelease docs version'
          );
          assert.strictEqual(
            narrative.docs_revision,
            audit.docs_revision,
            'narrative and release audit docs revisions'
          );
          assert.strictEqual(
            narrative.summary && narrative.summary.markdown_sources,
            narrative.route_inventory && narrative.route_inventory.length,
            'narrative audit Markdown source count matches the built route inventory'
          );

          console.log(
            `Deploying public artifact tuple: ${Object.entries(expected)
              .map(([name, version]) => `${name}=${version}`)
              .join(', ')}`
          );
          NODE

      # Popular action to deploy to GitHub Pages:
      # Docs: https://github.com/peaceiris/actions-gh-pages#%EF%B8%8F-docusaurus
      - name: Deploy to GitHub Pages
        if: steps.deploy-plan.outputs.deploy == 'true'
        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          # Build output to publish to the `gh-pages` branch:
          publish_dir: ./build
          # The following lines assign commit authorship to the official
          # GH-Actions bot for deploys to `gh-pages` branch:
          # https://github.com/actions/checkout/issues/13#issuecomment-724415212
          # The GH actions bot is used by default if you didn't specify the two fields.
          # You can swap them out with your own user credentials.
          user_name: github-actions[bot]
          user_email: 41898282+github-actions[bot]@users.noreply.github.com
          force_orphan: true

      - name: Verify live docs release audit
        if: steps.deploy-plan.outputs.deploy == 'true'
        run: node scripts/verify-docs-release-live.js

      - name: Verify live workflow lifecycle authority
        if: steps.deploy-plan.outputs.deploy == 'true'
        run: node scripts/verify-workflow-lifecycle-live.js

      - name: Report current live tuple
        if: steps.deploy-plan.outputs.deploy != 'true'
        run: echo "Live public artifact tuple already matches main; skipping scheduled deploy."