pixie-lab 0.1.0__tar.gz

pixie_lab-0.1.0/.dockerignore

@@ -0,0 +1,23 @@
+.git
+.github
+.gitignore
+.dockerignore
+.venv
+venv
+__pycache__
+*.py[cod]
+*.so
+.Python
+build
+dist
+*.egg-info
+.pytest_cache
+.mypy_cache
+.ruff_cache
+htmlcov
+.coverage
+coverage.xml
+.idea
+.vscode
+docs
+PLAN.md

pixie_lab-0.1.0/.github/workflows/cicd.yaml

@@ -0,0 +1,604 @@
+name: cicd
+
+# Jobs:
+#   * ``test``: fast unit tests on the Python matrix.
+#   * ``integration``: builds the container, starts it under podman,
+#     runs ``pytest -m integration`` against the running container
+#     (real nbdkit, real HTTP, real NBD wire).
+#   * ``build-container``: separate smoke build kept for the "does
+#     the Containerfile parse on a fresh runner" signal.
+#   * ``build-media``: build the live-env media (netboot-pc + usbboot-pc
+#     variants) via the cijoe pipelines under cijoe/tasks/. Requires
+#     live-build + passwordless sudo; the runner has both.
+#   * ``build-wheel``: sdist + wheel for PyPI. Runs on every push +
+#     PR so the packaging story is exercised regardless of tag state.
+#   * ``publish-pypi``: trusted publishing of the wheel + sdist,
+#     fires ONLY on ``v*`` tag pushes. PyPI is for life -- a published
+#     version cannot be re-uploaded -- so the job gates on every
+#     prior job (test + integration + build-container + build-wheel
+#     + build-media + every PXE chain test) succeeding first.
+#
+# First publish (claiming the pixie-lab name) requires a one-time
+# PyPI setup: register a Pending Publisher on https://pypi.org
+# targeting:
+#   PyPI Project Name:  pixie-lab
+#   Owner:              safl
+#   Repository:         pixie
+#   Workflow filename:  cicd.yaml
+#   Environment name:   pypi
+# Then push a ``v*`` tag (e.g. ``v0.1.0``) and publish-pypi claims
+# and uploads the release.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test (lint + typecheck + pytest ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v7.2.1
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: uv sync --all-extras --group dev
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run mypy src
+      - run: uv run pytest -v
+
+  integration:
+    name: Integration (real container + real nbdkit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v7.2.1
+        with:
+          python-version: "3.13"
+      - name: Install podman
+        run: |
+          # GHA ubuntu-latest already ships podman; a version check
+          # documents what we got and fails loud if podman disappears
+          # from the runner image later.
+          podman --version
+      - run: uv sync --all-extras --group dev
+      # The integration suite's ``container`` fixture builds
+      # ``pixie:integration-test`` on demand, but running the build
+      # explicitly here surfaces build failures as their own step
+      # rather than buried in a pytest skip.
+      - name: Build pixie container
+        run: podman build -t pixie:integration-test -f Containerfile .
+      - name: Run integration tests
+        run: uv run pytest -v -m integration -o addopts=
+
+  build-container:
+    name: Build container (smoke)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - run: podman build -t pixie:ci -f Containerfile .
+
+  build-media:
+    name: Build ${{ matrix.variant }} image
+    needs: test
+    runs-on: ubuntu-latest
+    # A cold live-build (netboot-pc / usbboot-pc) finishes in
+    # 25-40 min on a warm GHA runner. The dominant failure mode is
+    # a HANG (in-chroot apt / debootstrap has no timeout), so a 60
+    # min cap fails a stuck build fast; the cijoe-output artifact
+    # uploaded below (if: always()) carries the captured console +
+    # report.html for the post-mortem.
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        variant: [netboot-pc, usbboot-pc]
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install build dependencies
+        # Ubuntu's ``live-build`` package (20230502 on Noble) still
+        # fetches ``dists/<release>/Contents-<arch>.gz`` to resolve
+        # which package provides the kernel image; Debian moved
+        # Contents-*.gz under ``main/`` (per-component) for every
+        # active release, so the top-level URL 404s and the build
+        # aborts. Debian's pool ships a newer live-build (20240208+)
+        # with the fixed URL handling. Grab the latest .deb straight
+        # from the pool via wget + dpkg; live-build is Architecture:
+        # all (shell + perl, no libc dep) so a one-shot cross-distro
+        # install is safe.
+        run: |
+          set -eu
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            debootstrap squashfs-tools xorriso debian-archive-keyring \
+            exfatprogs exfat-fuse
+          POOL=http://ftp.debian.org/debian/pool/main/l/live-build
+          LB_DEB=$(curl -s "$POOL/" \
+              | grep -oE 'live-build_[0-9][^"<]*\.deb' \
+              | sort -V | tail -1)
+          if [ -z "$LB_DEB" ]; then
+              echo "could not find live-build .deb in $POOL/" >&2
+              exit 1
+          fi
+          echo "Fetching $LB_DEB"
+          wget -q "$POOL/$LB_DEB"
+          sudo dpkg -i "$LB_DEB"
+          lb --version
+
+      - name: Install cijoe
+        run: pipx install --force cijoe
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+
+      - name: Build image
+        run: make build VARIANT=${{ matrix.variant }}
+
+      # cijoe captures the full run (per-command output incl. the
+      # in-chroot log + a rendered report.html) under
+      # cijoe/cijoe-output/. Upload it ALWAYS; on a hang/timeout
+      # this is the only window into what the bake was stuck on.
+      - name: Upload cijoe output
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: cijoe-output-${{ matrix.variant }}
+          path: cijoe/cijoe-output
+          if-no-files-found: warn
+
+      - name: Upload artifact (netboot-pc)
+        if: matrix.variant == 'netboot-pc'
+        uses: actions/upload-artifact@v7
+        with:
+          name: pixie-netboot-pc-x86_64
+          path: |
+            ~/system_imaging/disk/pixie-netboot-pc-x86_64-v*.vmlinuz
+            ~/system_imaging/disk/pixie-netboot-pc-x86_64-v*.initrd
+            ~/system_imaging/disk/pixie-netboot-pc-x86_64-v*.squashfs
+            ~/system_imaging/disk/pixie-netboot-pc-x86_64-v*.sha256
+
+      - name: Upload artifact (usbboot-pc)
+        if: matrix.variant == 'usbboot-pc'
+        uses: actions/upload-artifact@v7
+        with:
+          name: pixie-usbboot-pc-x86_64
+          path: |
+            ~/system_imaging/disk/pixie-usbboot-pc-x86_64-v*.iso.gz
+            ~/system_imaging/disk/pixie-usbboot-pc-x86_64-v*.sha256
+
+  test-pxe:
+    name: PXE bootstrap chain test (containerized pixie + client QEMU VM)
+    # Independent of the media bake: the chain test only needs the
+    # container to serve /pxe-bootstrap.ipxe + /pxe/<mac>. Wire it to
+    # ``test`` so we don't pay for QEMU on a broken lint/typecheck.
+    needs: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install host tools (qemu, dnsmasq, ipxe, bridge)
+        run: |
+          set -eu
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            qemu-system-x86 \
+            qemu-utils \
+            dnsmasq \
+            ipxe \
+            bridge-utils \
+            iproute2
+          # /dev/kvm is crw-rw---- root:kvm on the runner but the
+          # runner user is not in the kvm group, so QEMU -enable-kvm
+          # fails "Permission denied". Widen the ACL rather than
+          # mess with group membership (which needs a fresh login
+          # to take effect).
+          sudo chmod a+rw /dev/kvm
+          ls -la /dev/kvm
+
+      - name: Install cijoe
+        run: pipx install --force cijoe
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+
+      - name: Run PXE bootstrap chain test
+        run: make test-pxe
+
+      # cijoe writes the full run (per-command output + report.html)
+      # under cijoe/cijoe-output/; upload it ALWAYS so a hang / marker
+      # miss leaves a diagnosable artifact.
+      - name: Upload cijoe output
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: cijoe-output-test-pxe
+          path: cijoe/cijoe-output
+          if-no-files-found: warn
+
+      - name: Upload PXE workspace (serial logs, dnsmasq.log)
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-pxe-workspace
+          path: cijoe/_build/test-pxe
+          if-no-files-found: warn
+
+  test-pxe-nbdboot:
+    name: PXE nbdboot chain test (containerized pixie + client QEMU VM)
+    # No build-media dependency: this test no longer uses pixie's own
+    # netboot-pc bake. It fetches a real nosi netboot bundle + disk
+    # image via oras from ghcr.io -- kernel/initrd from nosi's
+    # netboot bundle, root disk from nosi's img.gz -- and asserts a
+    # real Debian userspace comes up over NBD.
+    #
+    # 60 min timeout for the same reasons as test-pxe-flash: the real
+    # oras pull (~2.6 GiB compressed) + img.gz decompression to
+    # pixie's blob store dominates wall clock.
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install host tools (qemu, dnsmasq, ipxe, bridge)
+        run: |
+          set -eu
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            qemu-system-x86 \
+            qemu-utils \
+            dnsmasq \
+            ipxe \
+            bridge-utils \
+            iproute2
+          sudo chmod a+rw /dev/kvm
+          ls -la /dev/kvm
+
+      - name: Install cijoe
+        run: pipx install --force cijoe
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+
+      - name: Run PXE nbdboot chain test
+        run: make test-pxe-nbdboot
+
+      - name: Upload cijoe output
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: cijoe-output-test-pxe-nbdboot
+          path: cijoe/cijoe-output
+          if-no-files-found: warn
+
+      - name: Upload PXE workspace (serial logs, dnsmasq.log)
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-pxe-nbdboot-workspace
+          path: cijoe/_build/test-pxe
+          if-no-files-found: warn
+
+  test-pxe-inventory:
+    name: PXE inventory chain test (containerized pixie + client QEMU VM)
+    # Depends on the netboot-pc bake for the live-env media that
+    # pixie serves at /boot/pixie-live-env/. No disk image assembly
+    # here (unlike nbdboot), so the runner does not need
+    # squashfs-tools / rsync / mkfs.ext4.
+    needs: build-media
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install host tools (qemu, dnsmasq, ipxe, bridge)
+        run: |
+          set -eu
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            qemu-system-x86 \
+            qemu-utils \
+            dnsmasq \
+            ipxe \
+            bridge-utils \
+            iproute2
+          sudo chmod a+rw /dev/kvm
+          ls -la /dev/kvm
+
+      - name: Install cijoe
+        run: pipx install --force cijoe
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+
+      - name: Download netboot-pc bake artifacts
+        uses: actions/download-artifact@v7
+        with:
+          name: pixie-netboot-pc-x86_64
+          path: ~/system_imaging/disk/
+
+      - name: Show downloaded artifact contents
+        run: |
+          set -eu
+          echo "--- ~/system_imaging/disk (recursive) ---"
+          find ~/system_imaging/disk -maxdepth 5 -print
+
+      - name: Run PXE inventory chain test
+        run: make test-pxe-inventory
+
+      - name: Upload cijoe output
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: cijoe-output-test-pxe-inventory
+          path: cijoe/cijoe-output
+          if-no-files-found: warn
+
+      - name: Upload PXE workspace (serial logs, dnsmasq.log)
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-pxe-inventory-workspace
+          path: cijoe/_build/test-pxe
+          if-no-files-found: warn
+
+  test-pxe-flash:
+    name: PXE flash chain test (containerized pixie + client QEMU VM)
+    # Same artifact dependency as test-pxe-inventory (the netboot-pc
+    # bake for the live-env media). qemu-utils lands qemu-img which
+    # we use to read the client disk's sector 0 for a boot-signature
+    # check without a full-disk convert.
+    #
+    # Wider timeout (60 min) because the pipeline pulls a real nosi
+    # image via oras (~2.6 GiB compressed) + decompresses img.gz +
+    # dds ~10 GiB sparsely to the client qcow2 -- not the synthetic
+    # 16 MiB marker file the earlier test-pxe-flash iterations used.
+    needs: build-media
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install host tools (qemu, dnsmasq, ipxe, bridge)
+        run: |
+          set -eu
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            qemu-system-x86 \
+            qemu-utils \
+            dnsmasq \
+            ipxe \
+            bridge-utils \
+            iproute2
+          sudo chmod a+rw /dev/kvm
+          ls -la /dev/kvm
+
+      - name: Install cijoe
+        run: pipx install --force cijoe
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+
+      - name: Download netboot-pc bake artifacts
+        uses: actions/download-artifact@v7
+        with:
+          name: pixie-netboot-pc-x86_64
+          path: ~/system_imaging/disk/
+
+      - name: Show downloaded artifact contents
+        run: |
+          set -eu
+          echo "--- ~/system_imaging/disk (recursive) ---"
+          find ~/system_imaging/disk -maxdepth 5 -print
+
+      - name: Run PXE flash chain test
+        run: make test-pxe-flash
+
+      - name: Upload cijoe output
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: cijoe-output-test-pxe-flash
+          path: cijoe/cijoe-output
+          if-no-files-found: warn
+
+      - name: Upload PXE workspace (serial logs, dnsmasq.log)
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-pxe-flash-workspace
+          path: cijoe/_build/test-pxe
+          if-no-files-found: warn
+
+  test-pxe-flash-always:
+    name: PXE flash-always chain test (containerized pixie + client QEMU VM)
+    # Same dependencies + real-nosi pipeline as test-pxe-flash. The
+    # difference is a one-line config knob + an inverted assertion:
+    # pixie-flash-always must NOT flip its bind on the CLI's /done.
+    # 60 min for the same reasons -- real oras pull dominates.
+    needs: build-media
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install host tools (qemu, dnsmasq, ipxe, bridge)
+        run: |
+          set -eu
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            qemu-system-x86 \
+            qemu-utils \
+            dnsmasq \
+            ipxe \
+            bridge-utils \
+            iproute2
+          sudo chmod a+rw /dev/kvm
+          ls -la /dev/kvm
+
+      - name: Install cijoe
+        run: pipx install --force cijoe
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+
+      - name: Download netboot-pc bake artifacts
+        uses: actions/download-artifact@v7
+        with:
+          name: pixie-netboot-pc-x86_64
+          path: ~/system_imaging/disk/
+
+      - name: Show downloaded artifact contents
+        run: |
+          set -eu
+          echo "--- ~/system_imaging/disk (recursive) ---"
+          find ~/system_imaging/disk -maxdepth 5 -print
+
+      - name: Run PXE flash-always chain test
+        run: make test-pxe-flash-always
+
+      - name: Upload cijoe output
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: cijoe-output-test-pxe-flash-always
+          path: cijoe/cijoe-output
+          if-no-files-found: warn
+
+      - name: Upload PXE workspace (serial logs, dnsmasq.log)
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-pxe-flash-always-workspace
+          path: cijoe/_build/test-pxe
+          if-no-files-found: warn
+
+  test-pxe-tui:
+    name: PXE tui chain test (containerized pixie + client QEMU VM)
+    # Same live-env media dependency as test-pxe-flash. No qemu-utils
+    # here -- the tui test does not read the target disk; it just
+    # asserts the wizard entered its picker screen (a serial marker
+    # coming out of pixie CLI's _screen_select_image).
+    needs: build-media
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install host tools (qemu, dnsmasq, ipxe, bridge)
+        run: |
+          set -eu
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            qemu-system-x86 \
+            qemu-utils \
+            dnsmasq \
+            ipxe \
+            bridge-utils \
+            iproute2
+          sudo chmod a+rw /dev/kvm
+          ls -la /dev/kvm
+
+      - name: Install cijoe
+        run: pipx install --force cijoe
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+
+      - name: Download netboot-pc bake artifacts
+        uses: actions/download-artifact@v7
+        with:
+          name: pixie-netboot-pc-x86_64
+          path: ~/system_imaging/disk/
+
+      - name: Show downloaded artifact contents
+        run: |
+          set -eu
+          echo "--- ~/system_imaging/disk (recursive) ---"
+          find ~/system_imaging/disk -maxdepth 5 -print
+
+      - name: Run PXE tui chain test
+        run: make test-pxe-tui
+
+      - name: Upload cijoe output
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: cijoe-output-test-pxe-tui
+          path: cijoe/cijoe-output
+          if-no-files-found: warn
+
+      - name: Upload PXE workspace (serial logs, dnsmasq.log)
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-pxe-tui-workspace
+          path: cijoe/_build/test-pxe
+          if-no-files-found: warn
+
+  build-wheel:
+    name: Build wheel + sdist
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v8.1.0
+        with:
+          python-version: "3.12"
+      - run: uv build
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  publish-pypi:
+    name: Publish to PyPI
+    # Strictly last: gates on every prior job (test, integration,
+    # build-container, build-wheel, build-media, every PXE chain
+    # test) succeeding first. PyPI is for life; a version can never
+    # be re-uploaded, so we only ship once the whole release
+    # pipeline has gone through cleanly.
+    needs:
+      - test
+      - integration
+      - build-container
+      - build-wheel
+      - build-media
+      - test-pxe
+      - test-pxe-nbdboot
+      - test-pxe-inventory
+      - test-pxe-tui
+      - test-pxe-flash
+      - test-pxe-flash-always
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    environment:
+      name: pypi
+      url: https://pypi.org/p/pixie-lab
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          # Idempotent on retries -- if the version is already on PyPI
+          # (a previous half-failed run uploaded the wheel and a
+          # later job is retrying), succeed silently rather than
+          # fail.
+          skip-existing: true

pixie_lab-0.1.0/.github/workflows/docs.yml

@@ -0,0 +1,86 @@
+name: Docs
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build:
+    name: Build docs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v8.1.0
+        with:
+          python-version: "3.12"
+      - name: Install LaTeX (for PDF build)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            texlive-latex-recommended \
+            texlive-latex-extra \
+            texlive-fonts-recommended \
+            tex-gyre \
+            fonts-freefont-otf \
+            latexmk \
+            make
+      - name: Install docs tooling
+        run: uv tool install ./docs/tooling
+      - name: Build HTML
+        working-directory: docs
+        run: pixie-docs-build-html
+      - name: Build PDF
+        working-directory: docs
+        run: pixie-docs-build-pdf
+      - uses: actions/upload-artifact@v7
+        with:
+          name: docs-html
+          path: docs/_build/html
+      - uses: actions/upload-artifact@v7
+        with:
+          name: docs-pdf
+          path: docs/_build/latex/pixie.pdf
+
+  deploy:
+    name: Deploy to GitHub Pages
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+      contents: read
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: docs-html
+          path: html/
+      - uses: actions/configure-pages@v6
+      # When the deploy job is re-attempted within the same workflow
+      # run, the prior attempt's ``github-pages`` artifact survives.
+      # ``upload-pages-artifact`` happily adds a second one with the
+      # same name, then ``deploy-pages`` aborts on "Multiple artifacts
+      # named github-pages were unexpectedly found for this workflow
+      # run". Delete any pre-existing copy before the upload so the
+      # re-run is idempotent.
+      - name: Drop any prior github-pages artifact from this run
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          ids=$(gh api "repos/${{ github.repository }}/actions/runs/${RUN_ID}/artifacts" \
+            --jq '.artifacts[] | select(.name == "github-pages") | .id')
+          for id in ${ids}; do
+            echo "deleting stale github-pages artifact id=${id}"
+            gh api --method DELETE "repos/${{ github.repository }}/actions/artifacts/${id}"
+          done
+      - uses: actions/upload-pages-artifact@v5
+        with:
+          path: html/
+      - id: deployment
+        uses: actions/deploy-pages@v5