First implementation (#1)

Reviewed-on: #1

.gitea/workflows/site.yml

@@ -0,0 +1,59 @@
+# Builds and checks the website on every push to main, and publishes it to /srv/www/paperspec; see deploy/README.md.
+# The linux-base runner mounts the host's /srv/www into its job containers, so publishing is a local copy.
+name: site
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: site-publish
+  cancel-in-progress: false
+defaults:
+  run:
+    shell: bash
+env:
+  SITE_ROOT: /srv/www
+  SITE_SLUG: paperspec
+jobs:
+  site:
+    runs-on: linux-base
+    container:
+      image: git.scient.ing/infra/linux-base:26.10.7
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Restore the environment
+        uses: actions/cache@v4
+        with:
+          path: .pixi/envs
+          key: pixi-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pixi.lock') }}
+          restore-keys: pixi-${{ runner.os }}-${{ runner.arch }}-
+      - name: Install the environment
+        run: pixi install --locked
+      - name: Check the repository and the site
+        run: pixi run --frozen quick
+      - name: Build the site
+        run: pixi run --frozen site --out _site
+      - name: Publish the site
+        if: github.ref == 'refs/heads/main'
+        run: |
+          if [ ! -d "$SITE_ROOT" ]; then
+            echo "$SITE_ROOT is not mounted on this runner, so the site was built and checked but not published."
+            exit 0
+          fi
+          case "$SITE_SLUG" in
+            ''|*/*|.*) echo "SITE_SLUG must be a plain folder name, not '$SITE_SLUG'." >&2; exit 1 ;;
+          esac
+          if [ ! -f _site/index.html ] || [ ! -f _site/404.html ]; then
+            echo "_site/ has no index.html or 404.html, so it was not published." >&2
+            exit 1
+          fi
+          # --checksum without --times leaves unchanged files untouched, so their Last-Modified and ETag stay valid
+          # in caches; --delay-updates and --delete-delay apply the changes together at the end of the copy, and
+          # --chmod keeps every file readable by the web server whatever the container's umask.
+          rsync --recursive --links --perms --chmod=D755,F644 --checksum --delay-updates --delete-delay --stats \
+            _site/ "$SITE_ROOT/$SITE_SLUG/"