infra/paperspec
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: run the check and site workflows on the linux-base runner

Browse Source 
Drop the hosted setup-pixi step for the self-hosted runner, install the locked environment in the site workflow, run the quick check before building, and serialize publishes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
alexmandClaude committed 2026-10-15 04:39:00 -04:00
1 parent a09d158e16
commit 977579285b
3 files changed
+75 -21
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

deploy/README.md
+10 -4
View File
@@ -41,16 +41,22 @@ Add it to the server's Caddy configuration, for example with an `import` line, a
## Publish from CI
The workflow `.gitea/workflows/site.yml` builds the site on every push to `main`, and publishes it with `rsync` over SSH when four repository secrets are set:
The workflow `.gitea/workflows/site.yml` runs on every push to `main`.
It installs the environment from `pixi.lock`, runs `pixi run quick`, builds the site, and publishes it with `rsync` when the repository secret `SITE_PATH` is set.
A failed check stops the publish, so the site never serves a release that does not pass its own checks.
Without `SITE_PATH` the workflow still builds and checks the site, and says that it did not publish.
| Secret | Holds |
| --- | --- |
| `SITE_HOST` | The server's host name. |
| `SITE_PATH` | The folder Caddy serves, such as `/srv/paperspec`: an absolute path at least two levels deep. |
| `SITE_HOST` | The server's host name. Leave it unset when the runner is the web server, and the site is copied to `SITE_PATH` on the runner. |
| `SITE_USER` | The account that owns the site folder. |
| `SITE_PATH` | The folder Caddy serves, such as `/srv/paperspec`. |
| `SITE_SSH_KEY` | A private SSH key whose public half is in that account's `authorized_keys`, and that can do nothing else. |
| `SITE_KNOWN_HOSTS` | The server's host keys, as lines of `known_hosts`. |
Without `SITE_HOST` the workflow still builds and checks the site, and says that it did not publish.
The last three are needed only with `SITE_HOST`.
Take `SITE_KNOWN_HOSTS` from `ssh-keyscan -H <host>` on a network you trust, and compare its fingerprints with `ssh-keygen -lf` on the server; the workflow refuses a server whose key does not match.
Copying only changed files keeps the `Last-Modified` and `ETag` of every other file, so caches stay valid across releases.
## Distributing packages