infra/paperspec
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: fix site actions
check / check (linux-base) (push) Failing after 0s
Details

Browse Source
This commit is contained in:
alexm committed 2026-10-15 05:06:20 -04:00
1 parent 3831b52a2b
commit 2e3917f9b1
3 files changed
+28 -61
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

deploy/Caddyfile
+2 -2
View File
@@ -1,8 +1,8 @@
# Serves the paperspec website built by `python3 tools/site.py` (the `_site/` folder), copied to /srv/paperspec.
# Serves the paperspec website built by `python3 tools/site.py` (the `_site/` folder), copied to /srv/www/paperspec.
# The site mirrors the repository, so every schema is served at its $id and the JSON-LD context at the address
# layers name; this file sets the media types those addresses need and lets any page fetch them.
paperspec.scient.ing {
root * /srv/paperspec
root * /srv/www/paperspec
encode zstd gzip
# Every file may be fetched from any origin: JSON-LD processors and schema validators in browsers need it.
deploy/README.md
+7 -13
View File
@@ -35,28 +35,22 @@ pixi run python -m http.server --directory _site 8000
## Serve it with Caddy
[Caddyfile](Caddyfile) serves `/srv/paperspec` at `paperspec.scient.ing`.
[Caddyfile](Caddyfile) serves `/srv/www/paperspec` at `paperspec.scient.ing`.
It sets the media types the data needs (`application/ld+json` for the context, `application/schema+json` for schemas, `application/jsonl` for vectors and package files), allows every file to be fetched from any origin, and serves `404.html` for missing paths.
Add it to the server's Caddy configuration, for example with an `import` line, and reload Caddy.
## Publish from CI
The workflow `.gitea/workflows/site.yml` runs on every push to `main`.
It installs the environment from `pixi.lock`, runs `pixi run quick`, builds the site, and publishes it with `rsync` when the repository secret `SITE_PATH` is set.
It installs the environment from `pixi.lock`, runs `pixi run quick`, builds the site, and copies it with `rsync` to `/srv/www/paperspec`, the folder Caddy serves.
A failed check stops the publish, so the site never serves a release that does not pass its own checks.
Without `SITE_PATH` the workflow still builds and checks the site, and says that it did not publish.
| Secret | Holds |
| --- | --- |
| `SITE_PATH` | The folder Caddy serves, such as `/srv/paperspec`: an absolute path at least two levels deep. |
| `SITE_HOST` | The server's host name. Leave it unset when the runner is the web server, and the site is copied to `SITE_PATH` on the runner. |
| `SITE_USER` | The account that owns the site folder. |
| `SITE_SSH_KEY` | A private SSH key whose public half is in that account's `authorized_keys`, and that can do nothing else. |
| `SITE_KNOWN_HOSTS` | The server's host keys, as lines of `known_hosts`. |
The copy is local: the `linux-base` runner starts each job in a container with the host's `/srv/www` mounted at the same path, so no key or secret is involved.
On a runner without that mount the workflow still builds and checks the site, and says that it did not publish.
`SITE_ROOT` and `SITE_SLUG` at the top of the workflow name the folder.
The last three are needed only with `SITE_HOST`.
Take `SITE_KNOWN_HOSTS` from `ssh-keyscan -H <host>` on a network you trust, and compare its fingerprints with `ssh-keygen -lf` on the server; the workflow refuses a server whose key does not match.
Copying only changed files keeps the `Last-Modified` and `ETag` of every other file, so caches stay valid across releases.
Only changed files are copied, so every other file keeps its `Last-Modified` and `ETag` and caches stay valid across releases.
The environment in `.pixi/envs` is cached between runs under the hash of `pixi.lock`, so a fresh container installs it only when the lock file changes.
## Distributing packages