docs.yml

name: Docs

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3

      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
        with:
          enable-cache: true

      # The OpenAPI generator imports lambda/app.py (needs Powertools) and
      # Zensical is in the docs group (installed in .venv). Install both
      # environments so each step runs in the one that has its imports.
      # --locked mirrors ci.yml and the Makefile: without it a stale uv.lock
      # silently re-resolves in the published-Pages build — the one pipeline
      # with no other gate on the dependency set.
      - name: Install Lambda env (for OpenAPI generation + unit coverage)
        run: UV_PROJECT_ENVIRONMENT=.venv-lambda uv sync --locked --only-group lambda --only-group test

      # The `test` group rides into .venv alongside cdk + docs so the combined
      # coverage badge can run the CDK suite here (it needs pytest under the CDK
      # interpreter). Zensical (docs group) builds the site; the cdk + test
      # groups run the construct tests for the coverage number.
      - name: Install CDK env (for Zensical build + CDK coverage)
        run: uv sync --locked --group cdk --group docs --group test

      - name: Generate OpenAPI spec
        run: UV_PROJECT_ENVIRONMENT=.venv-lambda uv run python scripts/generate_openapi.py

      - name: Build docs
        run: uv run zensical build

      # In-house coverage badge: compute the whole-repo combined coverage and
      # write the shields.io endpoint JSON straight into the built site, so it
      # deploys to Pages alongside the docs. The README badge reads it from
      # there via img.shields.io/endpoint — coverage data never leaves our
      # infrastructure (see the `coverage-badge` target in the Makefile). Runs
      # after `zensical build` so it lands in the final site/ before upload.
      - name: Generate coverage badge
        run: make coverage-badge COVERAGE_BADGE_JSON=site/coverage-badge.json

      - name: Prune uv cache
        run: uv cache prune --ci

      - name: Upload pages artifact
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5.0.0
        with:
          path: site

  deploy:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}

    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128  # v5.0.0