@ai-ecoverse/slicc-bios 1.30.0 → 1.30.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -3
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -568,15 +568,15 @@ Every shard runs the files with a failing test once more and passes when they pa
|
|
|
568
568
|
|
|
569
569
|
## Hosting
|
|
570
570
|
|
|
571
|
-
`main` is live at <https://seven.sliccy.ai/>, and every
|
|
571
|
+
`main` is live at <https://seven.sliccy.ai/>, and every `bb/**` branch at `https://<branch>.sliccy.ai/`, where the branch name is lowercased and runs of anything but letters and digits become `-` (`bb/edge-hosting` → <https://bb-edge-hosting.sliccy.ai/>). Other branches, Renovate's included, get no preview. Each host is its own origin, so a branch gets its own OPFS and service worker and can't disturb `seven`. `https://www.sliccy.ai/7/` serves the same `seven/` next to SLICC 6 (sliccy-ai#51, see [Next to SLICC 6](#next-to-slicc-6-wwwsliccyai7)).
|
|
572
572
|
|
|
573
573
|
The hosts are served by the [sliccy-ai](https://github.com/ai-ecoverse/sliccy-ai) worker from the R2 bucket `slicc-bios`. This repo only publishes into that bucket:
|
|
574
574
|
|
|
575
575
|
- [`edge/publish.mjs`](edge/publish.mjs) `<branch>` uploads `src/` to `seven/` for `main` and to `branches/<label>/` for every other branch, and deletes what the previous upload had and this one doesn't. A manifest next to it (`seven.json`, `branches/<label>.json`) records which branch owns the label, so two branches that map to the same label can't overwrite each other.
|
|
576
576
|
- The bucket expires everything under `branches/` 30 days after upload. Every push uploads all files again, so a branch stays up while it's active and disappears a month after its last push. Nothing needs to be cleaned up when a branch is deleted.
|
|
577
|
-
- [`.github/workflows/deploy.yml`](.github/workflows/deploy.yml) publishes on every push.
|
|
577
|
+
- [`.github/workflows/deploy.yml`](.github/workflows/deploy.yml) publishes on every push to `main` or a `bb/**` branch, on the `CERT_LIGHT_RUNNER` pool. A newer push to a `bb/**` branch cancels its running publish; a publish of `main` is never cancelled.
|
|
578
578
|
- **`main`** publishes `seven/` with `CLOUDFLARE_API_TOKEN`, an account token with Workers R2 Storage Write. That token could overwrite `seven/`, so it lives only in the `production` environment, whose deployment branch policy allows `main` alone. A branch that changes the workflow can't read it.
|
|
579
|
-
- **
|
|
579
|
+
- **A `bb/**` branch** holds no secret. It runs in the `preview` environment, with no approval step and `id-token: write`. `edge/publish.mjs` asks GitHub for the job's OIDC token (audience `https://sliccy.ai`) and publishes through the sliccy-ai worker's `/api/publish/*` route. The route checks the token's signature, issuer, audience, expiry, repository and branch, then derives `branches/<label>/` from the branch itself. A branch can only ever write its own prefix, and never `seven/`. It first writes a manifest listing both the previous upload's files and this one's, so a publish cancelled midway leaves every file it uploaded on the list for the next publish to delete. Then files go up eight at a time, then deletions, then the final manifest.
|
|
580
580
|
|
|
581
581
|
## Rules
|
|
582
582
|
|