infra/paperspec
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: fix site actions
check / check (linux-base) (push) Failing after 0s
Details

Browse Source
This commit is contained in:
alexm committed 2026-10-15 05:06:20 -04:00
1 parent 3831b52a2b
commit 2e3917f9b1
3 files changed
+28 -61
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

deploy/README.md
+7 -13
View File
@@ -35,28 +35,22 @@ pixi run python -m http.server --directory _site 8000
## Serve it with Caddy
[Caddyfile](Caddyfile) serves `/srv/paperspec` at `paperspec.scient.ing`.
[Caddyfile](Caddyfile) serves `/srv/www/paperspec` at `paperspec.scient.ing`.
It sets the media types the data needs (`application/ld+json` for the context, `application/schema+json` for schemas, `application/jsonl` for vectors and package files), allows every file to be fetched from any origin, and serves `404.html` for missing paths.
Add it to the server's Caddy configuration, for example with an `import` line, and reload Caddy.
## Publish from CI
The workflow `.gitea/workflows/site.yml` runs on every push to `main`.
It installs the environment from `pixi.lock`, runs `pixi run quick`, builds the site, and publishes it with `rsync` when the repository secret `SITE_PATH` is set.
It installs the environment from `pixi.lock`, runs `pixi run quick`, builds the site, and copies it with `rsync` to `/srv/www/paperspec`, the folder Caddy serves.
A failed check stops the publish, so the site never serves a release that does not pass its own checks.
Without `SITE_PATH` the workflow still builds and checks the site, and says that it did not publish.
| Secret | Holds |
| --- | --- |
| `SITE_PATH` | The folder Caddy serves, such as `/srv/paperspec`: an absolute path at least two levels deep. |
| `SITE_HOST` | The server's host name. Leave it unset when the runner is the web server, and the site is copied to `SITE_PATH` on the runner. |
| `SITE_USER` | The account that owns the site folder. |
| `SITE_SSH_KEY` | A private SSH key whose public half is in that account's `authorized_keys`, and that can do nothing else. |
| `SITE_KNOWN_HOSTS` | The server's host keys, as lines of `known_hosts`. |
The copy is local: the `linux-base` runner starts each job in a container with the host's `/srv/www` mounted at the same path, so no key or secret is involved.
On a runner without that mount the workflow still builds and checks the site, and says that it did not publish.
`SITE_ROOT` and `SITE_SLUG` at the top of the workflow name the folder.
The last three are needed only with `SITE_HOST`.
Take `SITE_KNOWN_HOSTS` from `ssh-keyscan -H <host>` on a network you trust, and compare its fingerprints with `ssh-keygen -lf` on the server; the workflow refuses a server whose key does not match.
Copying only changed files keeps the `Last-Modified` and `ETag` of every other file, so caches stay valid across releases.
Only changed files are copied, so every other file keeps its `Last-Modified` and `ETag` and caches stay valid across releases.
The environment in `.pixi/envs` is cached between runs under the hash of `pixi.lock`, so a fresh container installs it only when the lock file changes.
## Distributing packages