@mintlify/cli 4.0.1725 → 4.0.1726

package/__test__/deploy-github-actions.test.ts

@@ -0,0 +1,202 @@
+import { execFileSync, spawn } from 'node:child_process';
+import { EventEmitter } from 'node:events';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { deployFromGithubActions } from '../src/deploy-github-actions.js';
+
+const real = vi.hoisted(() => ({ spawn: undefined as unknown as typeof spawn }));
+vi.mock('node:child_process', async (importOriginal) => {
+  const original = await importOriginal<typeof import('node:child_process')>();
+  real.spawn = original.spawn;
+  return { ...original, spawn: vi.fn() };
+});
+
+const apiUrl = 'https://leaves.mintlify.com';
+const env = {
+  PATH: process.env.PATH,
+  HOME: process.env.HOME,
+  GITHUB_ACTIONS: 'true',
+  GITHUB_REPOSITORY: 'acme/monorepo',
+  ACTIONS_ID_TOKEN_REQUEST_URL: 'https://token.actions.example.com/request?api-version=2.0',
+  ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'request-token',
+};
+const write = {
+  remote: 'https://git.example.com/repo.git',
+  branch: 'main',
+  token: 'write-token',
+  tokenExpiresAt: '2026-12-01T00:00:00.000Z',
+};
+let repo: string;
+
+const gitIn = (cwd: string, ...args: string[]) =>
+  execFileSync('git', args, { cwd, encoding: 'utf8' }).trim();
+const response = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status });
+const pushCall = () => vi.mocked(spawn).mock.calls.find(([, args]) => args[0] === 'push');
+const stubFetch = (...bodies: Response[]) => {
+  const request = vi.fn();
+  for (const body of bodies) request.mockResolvedValueOnce(body);
+  vi.stubGlobal('fetch', request);
+  return request;
+};
+
+function pushExitsWith(code: number) {
+  vi.mocked(spawn).mockImplementation(((command: string, args: string[], options: object) => {
+    if (args[0] !== 'push') return real.spawn(command, args, options);
+    const child = new EventEmitter();
+    setImmediate(() => child.emit('close', code));
+    return child;
+  }) as typeof spawn);
+}
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  pushExitsWith(0);
+  repo = fs.mkdtempSync(path.join(os.tmpdir(), 'mint-gha-'));
+  fs.mkdirSync(path.join(repo, 'docs'));
+  fs.writeFileSync(path.join(repo, 'docs', 'docs.json'), '{}\n');
+  fs.writeFileSync(path.join(repo, 'app.ts'), 'export {};\n');
+  gitIn(repo, 'init', '-q', '-b', 'main');
+  gitIn(
+    repo,
+    '-c',
+    'user.name=Ada',
+    '-c',
+    'user.email=ada@acme.dev',
+    'commit',
+    '-q',
+    '--allow-empty',
+    '-m',
+    'root'
+  );
+  gitIn(repo, 'add', '-A');
+  gitIn(
+    repo,
+    '-c',
+    'user.name=Ada',
+    '-c',
+    'user.email=ada@acme.dev',
+    'commit',
+    '-q',
+    '-m',
+    'update docs'
+  );
+});
+afterEach(() => {
+  vi.unstubAllGlobals();
+  fs.rmSync(repo, { recursive: true, force: true });
+});
+
+describe('mint deploy in GitHub Actions', () => {
+  it('pushes only the docs directory as the site root', async () => {
+    const request = stubFetch(response({ value: 'oidc-jwt' }), response(write));
+    const directory = path.join(repo, 'docs');
+
+    await expect(
+      deployFromGithubActions({ apiUrl, directory, subdomain: 'my-docs' }, undefined, env)
+    ).resolves.toBe('https://my-docs.mintlify.site/');
+
+    expect(request.mock.calls[0]?.[0]).toBe(
+      `${env.ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${encodeURIComponent(apiUrl)}`
+    );
+    expect(request.mock.calls[1]?.[0]).toBe(`${apiUrl}/api/agent/deployments/github-actions/token`);
+    expect(request.mock.calls[1]?.[1].headers.Authorization).toBe('Bearer oidc-jwt');
+
+    const [, args, options] = pushCall() ?? [];
+    const commit = String(args?.[3]).replace(':refs/heads/main', '');
+    expect(args).toEqual(['push', '--force', write.remote, `${commit}:refs/heads/main`]);
+    expect(args?.join(' ')).not.toContain('write-token');
+    expect(gitIn(repo, 'rev-parse', `${commit}^{tree}`)).toBe(
+      gitIn(repo, 'rev-parse', 'HEAD:docs')
+    );
+    expect(gitIn(repo, 'log', '-1', '--format=%an <%ae>%n%s', commit)).toBe(
+      'Ada <ada@acme.dev>\nupdate docs'
+    );
+    expect(gitIn(repo, 'log', '-1', '--format=%b', commit)).toBe(
+      `Deployed from acme/monorepo@${gitIn(repo, 'rev-parse', 'HEAD')}`
+    );
+    expect(options?.env).toMatchObject({
+      GIT_CONFIG_COUNT: '1',
+      GIT_CONFIG_KEY_0: `http.${write.remote}.extraHeader`,
+      GIT_CONFIG_VALUE_0: `Authorization: Basic ${Buffer.from('x-access-token:write-token').toString('base64')}`,
+    });
+  });
+
+  it('pushes the whole tree from the repository root', async () => {
+    stubFetch(response({ value: 'oidc-jwt' }), response(write));
+    await deployFromGithubActions(
+      { apiUrl, directory: repo, subdomain: 'my-docs' },
+      undefined,
+      env
+    );
+    const commit = String(pushCall()?.[1]?.[3]).replace(':refs/heads/main', '');
+    expect(gitIn(repo, 'rev-parse', `${commit}^{tree}`)).toBe(
+      gitIn(repo, 'rev-parse', 'HEAD^{tree}')
+    );
+  });
+
+  it('appends to existing git config environment entries', async () => {
+    stubFetch(response({ value: 'oidc-jwt' }), response(write));
+    await deployFromGithubActions({ apiUrl, directory: repo, subdomain: 'my-docs' }, undefined, {
+      ...env,
+      GIT_CONFIG_COUNT: '2',
+      GIT_CONFIG_KEY_0: 'core.quotepath',
+      GIT_CONFIG_VALUE_0: 'false',
+      GIT_CONFIG_KEY_1: 'color.ui',
+      GIT_CONFIG_VALUE_1: 'false',
+    });
+    expect(pushCall()?.[2]?.env).toMatchObject({
+      GIT_CONFIG_COUNT: '3',
+      GIT_CONFIG_KEY_2: `http.${write.remote}.extraHeader`,
+    });
+  });
+
+  it('asks for id-token: write when OIDC is unavailable', async () => {
+    const request = stubFetch();
+    await expect(
+      deployFromGithubActions({ apiUrl, directory: repo, subdomain: 'my-docs' }, undefined, {
+        ...env,
+        ACTIONS_ID_TOKEN_REQUEST_URL: undefined,
+      })
+    ).rejects.toThrow('permissions: id-token: write');
+    expect(request).not.toHaveBeenCalled();
+  });
+
+  it('requires --subdomain', async () => {
+    await expect(
+      deployFromGithubActions({ apiUrl, directory: repo }, undefined, env)
+    ).rejects.toThrow('--subdomain');
+  });
+
+  it('fails clearly when the directory is not in the checkout', async () => {
+    const request = stubFetch();
+    await expect(
+      deployFromGithubActions(
+        { apiUrl, directory: os.tmpdir(), subdomain: 'my-docs' },
+        undefined,
+        env
+      )
+    ).rejects.toThrow('Could not read');
+    expect(request).not.toHaveBeenCalled();
+  });
+
+  it('explains how to trust the repository on 403', async () => {
+    stubFetch(response({ value: 'oidc-jwt' }), response({ error: 'forbidden' }, 403));
+    await expect(
+      deployFromGithubActions({ apiUrl, directory: repo, subdomain: 'my-docs' }, undefined, env)
+    ).rejects.toThrow(
+      "This repository/branch isn't trusted to deploy my-docs. Run `mint deploy --github` locally"
+    );
+    expect(pushCall()).toBeUndefined();
+  });
+
+  it('fails when git push fails', async () => {
+    pushExitsWith(1);
+    stubFetch(response({ value: 'oidc-jwt' }), response(write));
+    await expect(
+      deployFromGithubActions({ apiUrl, directory: repo, subdomain: 'my-docs' }, undefined, env)
+    ).rejects.toThrow('git push to the site repository failed');
+  });
+});

package/__test__/deploy-github-setup.test.ts

@@ -0,0 +1,239 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import {
+  GITHUB_WORKFLOW_PATH,
+  githubWorkflow,
+  parseGithubRemote,
+  setupGithubDeployment,
+  writeGithubWorkflow,
+} from '../src/deploy-github-setup.js';
+import { prepareAgentDeployment } from '../src/deploy.js';
+
+vi.mock('node:child_process', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('node:child_process')>()),
+  execFile: vi.fn(),
+}));
+vi.mock('../src/deploy.js', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../src/deploy.js')>()),
+  prepareAgentDeployment: vi.fn(),
+}));
+
+const apiUrl = 'https://leaves.mintlify.com';
+const site = {
+  status: 'ready' as const,
+  created: false,
+  deploymentId: 'id',
+  subdomain: 'my-docs',
+  remote: 'https://git.example.com/repo.git',
+  branch: 'main' as const,
+  expiresAt: '2026-12-01T00:00:00.000Z',
+};
+const credentials = {
+  registrationId: 'reg',
+  issuer: 'https://auth.example.com',
+  assertion: 'assertion',
+  claimToken: 'claim',
+  accessToken: 'access',
+};
+let root: string;
+
+function stubCommands(outputs: Record<string, string | NodeJS.ErrnoException>) {
+  vi.mocked(execFile).mockImplementation(((
+    command: string,
+    args: string[],
+    _options: unknown,
+    callback: (error: Error | null, stdout: string) => void
+  ) => {
+    const output = outputs[`${command} ${args[0]}`];
+    if (output instanceof Error) callback(output, '');
+    else if (output === undefined) callback(new Error('unexpected'), '');
+    else callback(null, `${output}\n`);
+  }) as unknown as typeof execFile);
+}
+
+beforeEach(async () => {
+  vi.resetAllMocks();
+  root = await fs.realpath(await fs.mkdtemp(path.join(os.tmpdir(), 'mint-github-')));
+  await fs.writeFile(path.join(root, 'docs.json'), '{}');
+  stubCommands({
+    'git rev-parse': root,
+    'git remote': 'git@github.com:acme/docs.git',
+    'gh api': JSON.stringify({ id: 123, full_name: 'acme/docs', default_branch: 'trunk' }),
+  });
+  vi.mocked(prepareAgentDeployment).mockResolvedValue({
+    status: 'ready',
+    site,
+    write: { remote: site.remote, branch: 'main', token: 'write', tokenExpiresAt: site.expiresAt },
+    created: false,
+    credentials,
+  });
+});
+afterEach(async () => {
+  vi.unstubAllGlobals();
+  await fs.rm(root, { recursive: true, force: true });
+});
+
+describe('parseGithubRemote', () => {
+  it.each([
+    'https://github.com/acme/docs',
+    'https://github.com/acme/docs.git',
+    'https://user@github.com/acme/docs.git',
+    'git@github.com:acme/docs.git',
+    'ssh://git@github.com/acme/docs.git',
+    'ssh://git@github.com:22/acme/docs',
+  ])('parses %s', (remote) => {
+    expect(parseGithubRemote(remote)).toEqual({ owner: 'acme', repo: 'docs' });
+  });
+  it('keeps dots in repository names', () => {
+    expect(parseGithubRemote('git@github.com:acme/docs.site.git')).toEqual({
+      owner: 'acme',
+      repo: 'docs.site',
+    });
+  });
+  it.each(['https://gitlab.com/acme/docs.git', 'git@example.com:acme/docs.git', 'docs'])(
+    'rejects %s',
+    (remote) => {
+      expect(parseGithubRemote(remote)).toBeNull();
+    }
+  );
+});
+
+describe('GitHub workflow', () => {
+  it('deploys the subdomain on pushes to the branch with OIDC', () => {
+    expect(githubWorkflow('release,stable', 'my-docs')).toBe(`name: Deploy to Mintlify
+on:
+  push:
+    branches: ["release,stable"]
+permissions:
+  id-token: write
+  contents: read
+concurrency:
+  group: mintlify-deploy
+  cancel-in-progress: true
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npx mint@latest deploy --subdomain my-docs
+`);
+  });
+  it('deploys only the docs folder of a monorepo', () => {
+    const workflow = githubWorkflow('main', 'my-docs', 'apps/docs');
+    expect(workflow).toContain('    paths: ["apps/docs/**", ".github/workflows/mintlify.yml"]\n');
+    expect(workflow).toContain(
+      '      - run: npx mint@latest deploy --subdomain my-docs --directory apps/docs\n'
+    );
+    expect(githubWorkflow('main', 'my-docs', 'my docs')).toContain('--directory "my docs"');
+  });
+  it('creates the workflow and accepts identical contents', async () => {
+    await expect(writeGithubWorkflow(root, 'a')).resolves.toBe('created');
+    await expect(writeGithubWorkflow(root, 'a')).resolves.toBe('unchanged');
+    expect(await fs.readFile(path.join(root, GITHUB_WORKFLOW_PATH), 'utf8')).toBe('a');
+  });
+  it('does not overwrite a different workflow without --force', async () => {
+    await writeGithubWorkflow(root, 'a');
+    await expect(writeGithubWorkflow(root, 'b')).rejects.toThrow('--force');
+    expect(await fs.readFile(path.join(root, GITHUB_WORKFLOW_PATH), 'utf8')).toBe('a');
+    await expect(writeGithubWorkflow(root, 'b', true)).resolves.toBe('updated');
+    expect(await fs.readFile(path.join(root, GITHUB_WORKFLOW_PATH), 'utf8')).toBe('b');
+  });
+});
+
+describe('mint deploy --github', () => {
+  const options = { apiUrl, directory: '', subdomain: 'my-docs' };
+
+  it('trusts the repository and writes the workflow', async () => {
+    const request = vi
+      .fn()
+      .mockResolvedValue(
+        new Response(JSON.stringify({ subdomain: 'my-docs', trustedRepos: [] }), { status: 200 })
+      );
+    vi.stubGlobal('fetch', request);
+
+    const result = await setupGithubDeployment({ ...options, directory: root }, vi.fn());
+
+    expect(vi.mocked(execFile).mock.calls.find(([command]) => command === 'gh')?.[1]).toEqual([
+      'api',
+      'repos/acme/docs',
+      '--jq',
+      '{id: .id, full_name: .full_name, default_branch: .default_branch}',
+    ]);
+    expect(request.mock.calls[0]?.[0]).toBe(`${apiUrl}/api/agent/deployments/trusted-repos`);
+    expect(request.mock.calls[0]?.[1].headers.Authorization).toBe('Bearer access');
+    expect(JSON.parse(request.mock.calls[0]?.[1].body)).toEqual({
+      repositoryId: '123',
+      repository: 'acme/docs',
+      branch: 'trunk',
+    });
+    expect(await fs.readFile(path.join(root, GITHUB_WORKFLOW_PATH), 'utf8')).toBe(
+      githubWorkflow('trunk', 'my-docs')
+    );
+    expect(result).toMatchObject({
+      siteUrl: 'https://my-docs.mintlify.site/',
+      repository: 'acme/docs',
+      branch: 'trunk',
+      workflow: 'created',
+    });
+  });
+
+  it('writes the workflow at the repository root for a docs subdirectory', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi
+        .fn()
+        .mockResolvedValue(
+          new Response(JSON.stringify({ subdomain: 'my-docs', trustedRepos: [] }), { status: 200 })
+        )
+    );
+    const docs = path.join(root, 'docs');
+    await fs.mkdir(docs);
+    await fs.writeFile(path.join(docs, 'docs.json'), '{}');
+    await setupGithubDeployment({ ...options, directory: docs }, vi.fn());
+    expect(await fs.readFile(path.join(root, GITHUB_WORKFLOW_PATH), 'utf8')).toBe(
+      githubWorkflow('trunk', 'my-docs', 'docs')
+    );
+  });
+
+  it('requires docs.json in the docs directory before provisioning', async () => {
+    const docs = path.join(root, 'empty');
+    await fs.mkdir(docs);
+    await expect(setupGithubDeployment({ ...options, directory: docs }, vi.fn())).rejects.toThrow(
+      'No docs.json'
+    );
+    expect(prepareAgentDeployment).not.toHaveBeenCalled();
+  });
+
+  it('rejects non-GitHub origins before provisioning', async () => {
+    stubCommands({ 'git rev-parse': root, 'git remote': 'https://gitlab.com/acme/docs.git' });
+    await expect(setupGithubDeployment({ ...options, directory: root }, vi.fn())).rejects.toThrow(
+      'not a github.com repository'
+    );
+    expect(prepareAgentDeployment).not.toHaveBeenCalled();
+  });
+
+  it('explains when gh is missing', async () => {
+    stubCommands({
+      'git rev-parse': root,
+      'git remote': 'https://github.com/acme/docs',
+      'gh api': Object.assign(new Error('spawn gh ENOENT'), { code: 'ENOENT' }),
+    });
+    await expect(setupGithubDeployment({ ...options, directory: root }, vi.fn())).rejects.toThrow(
+      'GitHub CLI (gh) is required'
+    );
+  });
+
+  it('does not support claimed sites yet', async () => {
+    vi.mocked(prepareAgentDeployment).mockResolvedValue({ status: 'claimed' });
+    const request = vi.fn();
+    vi.stubGlobal('fetch', request);
+    await expect(setupGithubDeployment({ ...options, directory: root }, vi.fn())).rejects.toThrow(
+      'not supported yet'
+    );
+    expect(request).not.toHaveBeenCalled();
+  });
+});

package/bin/agent-deployment.js

@@ -40,6 +40,10 @@ const writeTokenSchema = z.object({
     token: z.string().min(1),
     tokenExpiresAt: z.iso.datetime(),
 });
+const trustedReposSchema = z.object({
+    subdomain: z.string().min(1),
+    trustedRepos: z.array(z.object({ repositoryId: z.string(), repository: z.string(), branch: z.string() })),
+});
 export function provisionAgentSite(apiUrl, accessToken, settings) {
     return __awaiter(this, void 0, void 0, function* () {
         for (let attempt = 0; attempt < 4; attempt++) {
@@ -71,3 +75,21 @@ export function getAgentWriteToken(apiUrl, accessToken) {
         }), writeTokenSchema);
     });
 }
+export function getGithubActionsWriteToken(apiUrl, oidcToken, subdomain) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return agentResponse(yield agentRequest(`${apiUrl}/api/agent/deployments/github-actions/token`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${oidcToken}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ subdomain }),
+        }), writeTokenSchema);
+    });
+}
+export function trustGithubRepo(apiUrl, accessToken, repo) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return agentResponse(yield agentRequest(`${apiUrl}/api/agent/deployments/trusted-repos`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify(repo),
+        }), trustedReposSchema);
+    });
+}

package/bin/cli.js

@@ -24,6 +24,8 @@ import { comingSoon } from './comingSoon.js';
 import { setTelemetryEnabled } from './config.js';
 import { getConfigValue, setConfigValue, clearConfigValue } from './config.js';
 import { API_URL } from './constants.js';
+import { deployFromGithubActions, isGithubActions } from './deploy-github-actions.js';
+import { formatGithubSetup, setupGithubDeployment } from './deploy-github-setup.js';
 import { DEPLOY_HELP, deploymentInstructions } from './deploy-instructions.js';
 import { formatDeployment, prepareAgentDeployment } from './deploy.js';
 import { formatHandler } from './format.js';
@@ -141,11 +143,43 @@ export const cli = ({ packageName = 'mint' }) => {
         type: 'string',
         description: 'User email for an optional claim link',
     })
+        .option('github', {
+        type: 'boolean',
+        default: false,
+        description: 'Trust this GitHub repository to deploy the site and write a GitHub Actions workflow',
+    })
+        .option('force', {
+        type: 'boolean',
+        default: false,
+        description: 'With --github, overwrite an existing .github/workflows/mintlify.yml',
+    })
+        .conflicts('github', 'email')
         .example('$0 deploy --subdomain my-docs', 'Provision a site without signing in')
         .example('$0 deploy --email you@example.com', 'Get repository access and a claim link for the current site')
         .example('$0 deploy --new --subdomain another-site', 'Create another anonymous site')
+        .example('$0 deploy --github --subdomain my-docs', 'Deploy the site from GitHub Actions on every push to the default branch')
+        .example('$0 deploy --subdomain my-docs', 'In GitHub Actions with id-token: write, push the current commit to a trusted site')
         .epilog(DEPLOY_HELP), (argv) => __awaiter(void 0, void 0, void 0, function* () {
         try {
+            if (isGithubActions()) {
+                const siteUrl = yield deployFromGithubActions({ apiUrl: API_URL, directory: argv.directory, subdomain: argv.subdomain }, (message) => process.stderr.write(`${message}\n`));
+                process.stdout.write(`Pushed to ${argv.subdomain}; the build starts now.\nSite: ${siteUrl}\n`);
+                yield terminate(0);
+                return;
+            }
+            if (argv.github) {
+                const setup = yield setupGithubDeployment({
+                    apiUrl: API_URL,
+                    directory: argv.directory,
+                    subdomain: argv.subdomain,
+                    orgName: argv.orgName,
+                    newSite: argv.new,
+                    force: argv.force,
+                }, (message) => process.stderr.write(`Warning: ${message}\n`), (message) => process.stderr.write(`${message}\n`));
+                process.stdout.write(`${formatGithubSetup(setup)}\n`);
+                yield terminate(0);
+                return;
+            }
             const result = yield prepareAgentDeployment({
                 apiUrl: API_URL,
                 directory: argv.directory,

package/bin/deploy-github-actions.js

@@ -0,0 +1,102 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { z } from 'zod';
+import { getGithubActionsWriteToken } from './agent-deployment.js';
+import { AgentApiError } from './agent-http.js';
+import { agentSiteUrl } from './deploy.js';
+const oidcSchema = z.object({ value: z.string().min(1) });
+export function isGithubActions(env = process.env) {
+    return env.GITHUB_ACTIONS === 'true';
+}
+function getGithubOidcToken(env, audience) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+        const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+        if (!requestUrl || !requestToken) {
+            throw new Error('GitHub Actions did not provide an OIDC token. Add `permissions: id-token: write` to the workflow or job.');
+        }
+        let response;
+        try {
+            response = yield fetch(`${requestUrl}&audience=${encodeURIComponent(audience)}`, {
+                headers: { Authorization: `Bearer ${requestToken}` },
+                signal: AbortSignal.timeout(30000),
+            });
+        }
+        catch (_a) {
+            throw new Error('Could not request a GitHub Actions OIDC token. Retry the workflow.');
+        }
+        const parsed = oidcSchema.safeParse(yield response.json().catch(() => null));
+        if (!response.ok || !parsed.success) {
+            throw new Error(`Could not get a GitHub Actions OIDC token (HTTP ${response.status}). Check that the workflow has \`permissions: id-token: write\`.`);
+        }
+        return parsed.data.value;
+    });
+}
+function git(args, cwd, env) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('git', args, { cwd, env, stdio: ['ignore', 'pipe', 'inherit'] });
+        let out = '';
+        child.stdout.on('data', (chunk) => (out += chunk.toString()));
+        child.on('error', reject);
+        child.on('close', (code) => code === 0 ? resolve(out.trim()) : reject(new Error(`git ${args[0]} failed`)));
+    });
+}
+function commitDirectory(directory, env) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const prefix = yield git(['rev-parse', '--show-prefix'], directory, env);
+        const tree = yield git(['rev-parse', `HEAD:${prefix}`], directory, env);
+        const [name = '', email = '', date = '', sha = '', subject = ''] = (yield git(['log', '-1', '--format=%an%n%ae%n%aI%n%H%n%s'], directory, env)).split('\n');
+        const repository = env.GITHUB_REPOSITORY ? `${env.GITHUB_REPOSITORY}@` : '';
+        return git(['commit-tree', tree, '-m', subject, '-m', `Deployed from ${repository}${sha}`], directory, Object.assign(Object.assign({}, env), { GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_AUTHOR_DATE: date, GIT_COMMITTER_NAME: name, GIT_COMMITTER_EMAIL: email }));
+    });
+}
+function pushCommit(directory, commit, write, env) {
+    const index = Number(env.GIT_CONFIG_COUNT) || 0;
+    const credentials = Buffer.from(`x-access-token:${write.token}`).toString('base64');
+    return new Promise((resolve, reject) => {
+        const child = spawn('git', ['push', '--force', write.remote, `${commit}:refs/heads/${write.branch}`], {
+            cwd: directory,
+            stdio: ['ignore', 'inherit', 'inherit'],
+            env: Object.assign(Object.assign({}, env), { GIT_CONFIG_COUNT: String(index + 1), [`GIT_CONFIG_KEY_${index}`]: `http.${write.remote}.extraHeader`, [`GIT_CONFIG_VALUE_${index}`]: `Authorization: Basic ${credentials}` }),
+        });
+        const failed = () => reject(new Error('git push to the site repository failed.'));
+        child.on('error', failed);
+        child.on('close', (code) => (code === 0 ? resolve() : failed()));
+    });
+}
+export function deployFromGithubActions(options_1) {
+    return __awaiter(this, arguments, void 0, function* (options, progress = () => { }, env = process.env) {
+        const { apiUrl, subdomain } = options;
+        if (!subdomain)
+            throw new Error('Pass the site name with --subdomain <name>.');
+        const directory = path.resolve(options.directory);
+        const commit = yield commitDirectory(directory, env).catch(() => {
+            throw new Error(`Could not read ${options.directory} from the checked-out commit. Run mint deploy after actions/checkout, with --directory inside the repository.`);
+        });
+        progress('Requesting a GitHub Actions identity token...');
+        const oidcToken = yield getGithubOidcToken(env, apiUrl);
+        progress('Getting repository write access...');
+        let write;
+        try {
+            write = yield getGithubActionsWriteToken(apiUrl, oidcToken, subdomain);
+        }
+        catch (error) {
+            if (error instanceof AgentApiError && error.status === 403) {
+                throw new Error(`This repository/branch isn't trusted to deploy ${subdomain}. Run \`mint deploy --github\` locally from this repository to trust it.`);
+            }
+            throw error;
+        }
+        progress('Pushing to the site repository...');
+        yield pushCommit(directory, commit, write, env);
+        return agentSiteUrl(apiUrl, subdomain);
+    });
+}