ci: fix site actions

.gitea/workflows/site.yml

@@ -1,4 +1,5 @@
-# Builds and checks the website on every push to main, and publishes it when SITE_PATH is set; see deploy/README.md.
+# Builds and checks the website on every push to main, and publishes it to /srv/www/paperspec; see deploy/README.md.
+# The linux-base runner mounts the host's /srv/www into its job containers, so publishing is a local copy.
 name: site
 on:
   push:
@@ -6,14 +7,15 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
-# One publish at a time, so two pushes cannot interleave their transfers; a later run waits instead of cancelling
-# one halfway through.
 concurrency:
   group: site-publish
   cancel-in-progress: false
 defaults:
   run:
     shell: bash
+env:
+  SITE_ROOT: /srv/www
+  SITE_SLUG: paperspec
 jobs:
   site:
     runs-on: linux-base
@@ -22,63 +24,34 @@ jobs:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
-      # --locked fails when pixi.lock is out of date with pixi.toml instead of solving a new environment.
+      - name: Restore the environment
+        uses: actions/cache@v4
+        with:
+          path: .pixi/envs
+          key: pixi-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pixi.lock') }}
+          restore-keys: pixi-${{ runner.os }}-${{ runner.arch }}-
       - name: Install the environment
         run: pixi install --locked
-      # Everything but the byte-for-byte rebuild, including that every page, link and $id of the site resolves.
       - name: Check the repository and the site
         run: pixi run --frozen quick
       - name: Build the site
         run: pixi run --frozen site --out _site
       - name: Publish the site
         if: github.ref == 'refs/heads/main'
-        env:
-          SITE_HOST: ${{ secrets.SITE_HOST }}
-          SITE_USER: ${{ secrets.SITE_USER }}
-          SITE_PATH: ${{ secrets.SITE_PATH }}
-          SITE_SSH_KEY: ${{ secrets.SITE_SSH_KEY }}
-          SITE_KNOWN_HOSTS: ${{ secrets.SITE_KNOWN_HOSTS }}
         run: |
-          if [ -z "$SITE_PATH" ]; then
-            echo "SITE_PATH is not set, so the site was built and checked but not published."
+          if [ ! -d "$SITE_ROOT" ]; then
+            echo "$SITE_ROOT is not mounted on this runner, so the site was built and checked but not published."
             exit 0
           fi
-          # rsync --delete empties the folder it is given, so take only an absolute path at least two levels deep.
-          dest=${SITE_PATH%/}
-          case "$dest" in
-            /*/*) ;;
-            *) echo "SITE_PATH must be an absolute folder such as /srv/paperspec, not '$SITE_PATH'." >&2; exit 1 ;;
-          esac
-          case "$dest/" in
-            */../*|*/./*|*//*|*[[:space:]]*) echo "SITE_PATH must be a plain path, not '$SITE_PATH'." >&2; exit 1 ;;
+          case "$SITE_SLUG" in
+            ''|*/*|.*) echo "SITE_SLUG must be a plain folder name, not '$SITE_SLUG'." >&2; exit 1 ;;
           esac
           if [ ! -f _site/index.html ] || [ ! -f _site/404.html ]; then
             echo "_site/ has no index.html or 404.html, so it was not published." >&2
             exit 1
           fi
-          command -v rsync >/dev/null || { echo "rsync is not installed on the runner." >&2; exit 1; }
           # --checksum without --times leaves unchanged files untouched, so their Last-Modified and ETag stay valid
-          # in caches; --delay-updates and --delete-delay apply the changes together at the end of the transfer.
-          opts=(--recursive --links --perms --chmod=D755,F644 --checksum --delay-updates --delete-delay --stats)
-          if [ -z "$SITE_HOST" ]; then
-            # The runner is the web server.
-            if [ ! -d "$dest" ]; then
-              echo "$dest does not exist on the runner." >&2
-              exit 1
-            fi
-            rsync "${opts[@]}" _site/ "$dest/"
-            exit 0
-          fi
-          if [ -z "$SITE_USER" ] || [ -z "$SITE_SSH_KEY" ] || [ -z "$SITE_KNOWN_HOSTS" ]; then
-            echo "Publishing over SSH needs SITE_USER, SITE_SSH_KEY and SITE_KNOWN_HOSTS as well as SITE_HOST." >&2
-            exit 1
-          fi
-          # The key and host keys live in a private folder that is removed however the step ends.
-          keys=$(mktemp -d)
-          trap 'rm -rf "$keys"' EXIT
-          printf '%s\n' "$SITE_SSH_KEY" > "$keys/id"
-          printf '%s\n' "$SITE_KNOWN_HOSTS" > "$keys/known_hosts"
-          chmod 600 "$keys/id"
-          ssh="ssh -i $keys/id -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=yes"
-          ssh="$ssh -o UserKnownHostsFile=$keys/known_hosts -o ConnectTimeout=20 -o ServerAliveInterval=15"
-          rsync "${opts[@]}" --compress -e "$ssh" _site/ "$SITE_USER@$SITE_HOST:$dest/"
+          # in caches; --delay-updates and --delete-delay apply the changes together at the end of the copy, and
+          # --chmod keeps every file readable by the web server whatever the container's umask.
+          rsync --recursive --links --perms --chmod=D755,F644 --checksum --delay-updates --delete-delay --stats \
+            _site/ "$SITE_ROOT/$SITE_SLUG/"