chore(docs): harden CI supply chain + update deps (#401) #93
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy to GitHub Pages | |
| on: | |
| push: | |
| branches: | |
| - master | |
| # Daily rebuild + manual trigger — refreshes build-time data like the GitHub | |
| # star count in site/src/data/github.ts without a manual deploy. | |
| schedule: | |
| - cron: '0 6 * * *' | |
| # Allow manual runs from the Actions tab. | |
| workflow_dispatch: | |
| jobs: | |
| deploy: | |
| name: Deploy to GitHub Pages | |
| runs-on: ubuntu-latest | |
| # Least privilege: the build only needs to push the gh-pages branch. Limits | |
| # blast radius if a build-time dependency is ever compromised. | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: site/package-lock.json | |
| # --ignore-scripts blocks install/postinstall (and binding.gyp/node-gyp) | |
| # supply-chain vectors — see npm worm advisories (Shai-Hulud). The build | |
| # works without lifecycle scripts (sharp ships prebuilt binaries). | |
| - name: Install dependencies | |
| run: npm ci --ignore-scripts | |
| working-directory: site | |
| - name: Build website | |
| run: npm run build | |
| working-directory: site | |
| env: | |
| # Lifts the GitHub API rate limit for build-time stats fetches. | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Popular action to deploy to GitHub Pages: | |
| # Docs: https://github.com/peaceiris/actions-gh-pages#%EF%B8%8F-docusaurus | |
| - name: Deploy to GitHub Pages | |
| uses: peaceiris/actions-gh-pages@v4 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| # Build output to publish to the `gh-pages` branch: | |
| publish_dir: ./site/dist | |
| # The following lines assign commit authorship to the official | |
| # GH-Actions bot for deploys to `gh-pages` branch: | |
| # https://github.com/actions/checkout/issues/13#issuecomment-724415212 | |
| # The GH actions bot is used by default if you didn't specify the two fields. | |
| # You can swap them out with your own user credentials. | |
| user_name: github-actions[bot] | |
| user_email: 41898282+github-actions[bot]@users.noreply.github.com |