@augurworks/augur 0.15.1

package/templates/space/publish.yml

@@ -0,0 +1,91 @@
+# OPTIONAL. Push to main → this space is live in about a minute. No publish command to
+# run and none to forget.
+#
+# Only a PUBLIC space that auto-publishes its content on every push needs this (a demo
+# whose last pusher is often not the person who'd remember to publish). A working space
+# needs nothing here: it publishes deliberately from a terminal (`augur ship`/`publish`),
+# and its baked chrome is kept current with the engine by the DEPLOY SHELL — the shell's
+# deploy.yml re-bakes every roster space with its own `*`-scoped token when the engine pin
+# moves, so no space repo needs a token or CI just to stay on the current chrome.
+#
+# Why the two acts (push vs publish) are joined HERE for a public space, not in the shell:
+# the shell's engine build is structurally forbidden to ship content (GV_ENGINE_ONLY=1),
+# and this keeps to that — it runs the ordinary `augur publish` client with an ordinary
+# per-space token, exactly as a person would. Same door, no key under the mat.
+#
+# ── SETUP (one secret, once) ──────────────────────────────────────────────────────
+# AUGUR_TOKEN — a publish token scoped to THIS space, minted on the instance:
+#   1. sign in to the site in space.json `siteOrigin` as an admin
+#   2. Admin → Tokens → mint one for this space (label it so a revoke is obvious)
+#   3. gh secret set AUGUR_TOKEN -R <owner>/<this repo>
+# Scope it to this space, not "*": this repo may be public, and a star-scope token in a
+# public repo's CI can write every space on the instance. Fork pull requests never receive
+# it — that is why the triggers below are push / manual only, and pull_request must not be
+# added.
+#
+# The target is NOT configured here. It comes from space.json `siteOrigin` — so a fork that
+# repoints its space.json publishes to its own site and this file needs no edit.
+name: Publish to the live site
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: "Build and diff against live, ship nothing"
+        type: boolean
+        default: false
+
+# Newest push wins. Cancelling is safe: a publish commits atomically at the end, so an
+# interrupted run ships nothing at all.
+concurrency:
+  group: publish
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      # fetch-depth: 0 is load-bearing: publish.mjs REFUSES a shallow clone, because it
+      # reads each file's git history to date the cards and credit the editor.
+      - name: Check out this space
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          path: space
+
+      # The engine is public and carries no runtime dependencies. main, not a tag: this
+      # instance tracks the engine's main, and content should be built by the engine that
+      # will be serving it.
+      - name: Check out the engine
+        uses: actions/checkout@v4
+        with:
+          repository: andratwiro/augur
+          ref: main
+          path: engine
+
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+
+      - name: Fail early if the publish token is missing
+        env:
+          AUGUR_TOKEN: ${{ secrets.AUGUR_TOKEN }}
+        run: |
+          if [ -z "$AUGUR_TOKEN" ]; then
+            echo "::error::AUGUR_TOKEN is not set — see the setup notes at the top of this workflow."
+            exit 1
+          fi
+
+      # GV_SPACES_ROOT points AT this space so the build mounts it at the root. No
+      # AUGUR_ORIGIN: with no deploy shell on disk the origin resolves to space.json
+      # `siteOrigin`, which is what we want.
+      - name: Publish
+        working-directory: space
+        env:
+          AUGUR_TOKEN: ${{ secrets.AUGUR_TOKEN }}
+          GV_SPACES_ROOT: ${{ github.workspace }}/space
+        run: node ../engine/scripts/publish.mjs ${{ inputs.dry-run && '--dry-run' || '' }}