Repository navigation
fix(ipv6): CALIPSO make() writes a corrupt length on overflow and raises raw errors for a bad pad #3918
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: GitHub Pages | |
| on: | |
| # No `push: branches: [main]` here. `unit-tests.yml`'s own push trigger already | |
| # runs the full matrix for this commit; calling it again with `gate-only: true` | |
| # below re-ran the single-version "Gate" job a second time for the same tree | |
| # (#715). Chaining off `Unit Tests`' completion instead means the gate never | |
| # runs twice, and this workflow simply waits for the verdict that already | |
| # exists. `workflow_run` fires for *any* completion of that workflow, PR or | |
| # push, so the jobs below filter on `.event == 'push'` themselves rather than | |
| # trusting a `branches:` filter here to do it -- see the note on `deploy-pages`. | |
| workflow_run: | |
| workflows: ["Unit Tests"] | |
| types: [completed] | |
| schedule: | |
| - cron: '0 2 * * 6' | |
| pull_request: | |
| # Was '**', which matched pull requests against every branch and made this | |
| # the one workflow that fired outside the main-targeting set the others | |
| # use. Every pull request here targets main, so '**' only ever added runs. | |
| branches: [main] | |
| permissions: | |
| contents: write | |
| # Deliberately still keyed on the ref, unlike the validation workflows. This one | |
| # publishes a *latest state* rather than a verdict on a commit, so coalescing is | |
| # correct: when two pushes land close together the pending build is dropped and | |
| # the newer one publishes, and deploying the older commit's docs after the newer | |
| # ones would actively be wrong. GitHub Pages also permits only one live | |
| # deployment, so serialising here is a requirement rather than a saving. | |
| concurrency: | |
| group: pages-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| # Only earns its runners on the schedule trigger now: `Unit Tests` has no | |
| # schedule trigger of its own, so Saturday's cron run is the one case left | |
| # where nothing else has already verified this tree, and a gate is still | |
| # needed. Pull requests never published anyway, and `workflow_run` carries | |
| # its own verdict from the run that completed -- see `deploy-pages` below. | |
| unit-tests: | |
| name: Docs test gate | |
| if: ${{ github.event_name != 'pull_request' && github.event_name != 'workflow_run' }} | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/unit-tests.yml | |
| with: | |
| gate-only: true | |
| deploy-pages: | |
| needs: [ unit-tests ] | |
| # `needs` cannot itself be conditional, so a skipped gate (pull requests, | |
| # and now `workflow_run`) has to be accepted explicitly -- by default this | |
| # job would inherit the skip. `!cancelled()` rather than `always()` so that | |
| # cancelling the run still cancels the docs build; a gate that actually | |
| # failed still blocks. | |
| # | |
| # The `workflow_run` clause is the real gate for a push to main now: it | |
| # reads the verdict `Unit Tests` already reached for this exact commit | |
| # instead of re-running it. `.event == 'push'` and `.head_branch == 'main'` | |
| # both matter -- `workflow_run` fires for *every* completion of that | |
| # workflow, including one triggered by a pull request, and without this | |
| # check a green PR would publish docs from that PR's tree. | |
| if: >- | |
| !cancelled() && needs.unit-tests.result != 'failure' && | |
| (github.event_name != 'workflow_run' || ( | |
| github.event.workflow_run.conclusion == 'success' && | |
| github.event.workflow_run.event == 'push' && | |
| github.event.workflow_run.head_branch == 'main' | |
| )) | |
| concurrency: ci-${{ github.ref }} # Recommended if you intend to make multiple deployments in quick succession. | |
| runs-on: macos-latest | |
| steps: | |
| - name: Checkout 🛎️ | |
| uses: actions/checkout@v7 | |
| with: | |
| # Deliberately the default `github.sha` (main's tip), not | |
| # `github.event.workflow_run.head_sha`. Pinning to the latter once | |
| # ran here and CodeQL flagged it as "checkout of untrusted code in a | |
| # privileged context" -- `workflow_run` can also be raised by a pull | |
| # request's `Unit Tests` run, and that field would then be a fork's | |
| # commit. The `if:` above already keeps that path from reaching this | |
| # step, but making the ref itself always resolve to a trusted | |
| # default-branch commit removes the pattern outright rather than | |
| # relying on CodeQL tracing through the guard. `main`'s tip is also | |
| # the *right* commit for docs, which should reflect current main, | |
| # not a slightly older one -- so this is not a compromise here. | |
| persist-credentials: false | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3.14' | |
| # Builds the Sphinx documentation into `docs/build/html`, which the deploy | |
| # step below publishes. `PCAPKIT_SPHINX` is what makes the | |
| # `if SPHINX_TYPE_CHECKING:` TypedDicts visible to autodoc; `PCAPKIT_DEVMODE` | |
| # puts the library logger at DEBUG on stderr and leaves tracebacks untrimmed, | |
| # so an autodoc import failure is legible in the run log. Both are read at | |
| # import time, so they are exported before anything imports `pcapkit` -- | |
| # `docs/source/conf.py` sets `PCAPKIT_SPHINX` itself for the same reason. | |
| # `.[all,dev]`, not `.[all]` alone: autodoc imports every module, including | |
| # the engine wrappers, so it needs the same imports resolvable that | |
| # `lint.yml` does and for the same reason (#910's `dev` extra, added when | |
| # that issue narrowed `all` to core addons only). | |
| - name: Install and Build 🔧 | |
| run: | | |
| set -x | |
| export PCAPKIT_SPHINX=1 | |
| export PCAPKIT_DEVMODE=1 | |
| python -m pip install -U pip setuptools wheel | |
| python -m pip install -r docs/requirements.txt | |
| python -m pip install -e .[all,dev] | |
| rm -rf docs/build | |
| make -C docs html | |
| # disable Jekyll | |
| touch docs/build/html/.nojekyll | |
| - name: Deploy 🚀 | |
| uses: JamesIves/github-pages-deploy-action@v4 | |
| if: ${{ github.event_name != 'pull_request' }} | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| branch: gh-pages # The branch the action should deploy to. | |
| folder: docs/build/html # The folder the action should deploy. | |
| clean: true # Automatically remove deleted files from the deploy branch |