deploy-docs.yml

name: Deploy Docs to GitHub Pages

on:
  push:
    branches: [main]
  workflow_dispatch:

# Nothing is granted by default. Each job asks for exactly what it uses.
permissions:
  contents: read

concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    # configure-pages reads the Pages settings, which needs pages: read. The
    # build job renders and uploads an artifact; it publishes nothing, so it
    # has no write permission and no OIDC token.
    permissions:
      contents: read
      pages: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # Render the HTML reference for every synced schema version (the list
      # and the latest stable version live in scripts/schema-versions.json)
      # with the exactly-pinned renderer, so specs/ is complete before the
      # asset-sync step mirrors it into the published site. On a current
      # main this reproduces the committed files byte for byte; the
      # conformance workflow's `generated` job checks that on every PR.
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Generate schema docs (specs/)
        run: |
          pip install --require-hashes -r scripts/requirements-docs.lock
          python3 generate-docs.py

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      # docs:build runs scripts/sync-public-assets.mjs first, mirroring
      # schema/ + specs/ into docs/.vuepress/public/, then `vuepress build`.
      - name: Build docs
        run: npm run docs:build

      - name: Add .nojekyll
        run: touch docs/.vuepress/dist/.nojekyll

      - name: Setup Pages
        uses: actions/configure-pages@v4

      - name: Upload artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: docs/.vuepress/dist

  deploy:
    # The only job that publishes. It does not check out or build anything, so
    # it needs neither contents nor pages: read.
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v5