|
| 1 | +# SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors |
| 2 | +# SPDX-License-Identifier: AGPL-3.0-or-later |
| 3 | +# |
| 4 | +# Squash the gh-pages history on every release. |
| 5 | +# |
| 6 | +# Every deploy commits a full set of rebuilt PDF and ePub files, so gh-pages |
| 7 | +# grows by ~18 MiB a day. build/squash-gh-pages.sh rebuilds the branch as one |
| 8 | +# snapshot commit per release day, keeps the deploys made since the last |
| 9 | +# release, and stores out of support version folders only once. The published |
| 10 | +# tree is unchanged; see the script for details. |
| 11 | +# |
| 12 | +# Required setup (repository admin): |
| 13 | +# GH_PAGES_DEPLOY_KEY – private half of a deploy key with write access, added |
| 14 | +# as a bypass actor to the "Pages" ruleset, which |
| 15 | +# otherwise blocks force pushes to gh-pages. |
| 16 | +name: "Squash gh-pages history" |
| 17 | + |
| 18 | +on: |
| 19 | + push: |
| 20 | + tags: |
| 21 | + - 'v*' |
| 22 | + pull_request: |
| 23 | + paths: |
| 24 | + - '.github/workflows/squash-gh-pages.yml' |
| 25 | + - 'build/squash-gh-pages.sh' |
| 26 | + - 'build/tests/**' |
| 27 | + workflow_dispatch: |
| 28 | + inputs: |
| 29 | + dry_run: |
| 30 | + description: "Compute the rewrite without pushing it" |
| 31 | + type: boolean |
| 32 | + default: true |
| 33 | + |
| 34 | +permissions: |
| 35 | + contents: read |
| 36 | + |
| 37 | +concurrency: |
| 38 | + group: squash-gh-pages |
| 39 | + cancel-in-progress: false |
| 40 | + |
| 41 | +jobs: |
| 42 | + test: |
| 43 | + name: Test squash script |
| 44 | + runs-on: ubuntu-latest |
| 45 | + |
| 46 | + steps: |
| 47 | + - name: Checkout repository |
| 48 | + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| 49 | + with: |
| 50 | + persist-credentials: false |
| 51 | + |
| 52 | + - name: Run unit tests |
| 53 | + run: bash build/tests/test-squash-gh-pages.sh |
| 54 | + |
| 55 | + squash: |
| 56 | + name: Squash gh-pages |
| 57 | + needs: test |
| 58 | + # Final releases only: rc, beta and alpha tags do not get a snapshot. |
| 59 | + if: >- |
| 60 | + github.event_name == 'workflow_dispatch' || |
| 61 | + (github.event_name == 'push' && !contains(github.ref_name, 'rc') && |
| 62 | + !contains(github.ref_name, 'beta') && !contains(github.ref_name, 'alpha')) |
| 63 | + runs-on: ubuntu-latest |
| 64 | + |
| 65 | + permissions: |
| 66 | + contents: read |
| 67 | + |
| 68 | + steps: |
| 69 | + # Full history: the release dates are read from the tags. |
| 70 | + - name: Checkout repository |
| 71 | + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| 72 | + with: |
| 73 | + ref: ${{ github.event.repository.default_branch }} |
| 74 | + fetch-depth: 0 |
| 75 | + persist-credentials: false |
| 76 | + |
| 77 | + - name: Setup PHP |
| 78 | + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2 |
| 79 | + with: |
| 80 | + php-version: '8.3' |
| 81 | + |
| 82 | + - name: Detect lowest supported version |
| 83 | + id: versions |
| 84 | + env: |
| 85 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 86 | + run: | |
| 87 | + mapfile -t nums < <(git ls-remote --heads origin "heads/stable[0-9][0-9]" \ |
| 88 | + | sed -n 's?.*refs/heads/stable\([0-9]\{2\}\)$?\1?p' | sort -n) |
| 89 | + eval "$(php build/detect-versions.php "${nums[@]}")" |
| 90 | + echo "Folders below server/${lowest_stable} are frozen" |
| 91 | + echo "lowest_stable=${lowest_stable}" >> "$GITHUB_OUTPUT" |
| 92 | +
|
| 93 | + - name: Fetch gh-pages history |
| 94 | + run: git fetch --no-tags origin +refs/heads/gh-pages:refs/heads/gh-pages |
| 95 | + |
| 96 | + - name: Rewrite gh-pages |
| 97 | + id: rewrite |
| 98 | + run: | |
| 99 | + echo "old=$(git rev-parse gh-pages)" >> "$GITHUB_OUTPUT" |
| 100 | + build/squash-gh-pages.sh gh-pages "${{ steps.versions.outputs.lowest_stable }}" \ |
| 101 | + refs/heads/gh-pages-squashed | tee -a "$GITHUB_OUTPUT" |
| 102 | +
|
| 103 | + # Deploy PRs are based on the old history: merging one after the rewrite |
| 104 | + # would bring every squashed commit back. The next nightly deploy opens a |
| 105 | + # fresh one on top of the new history. |
| 106 | + - name: Close open deploy pull requests |
| 107 | + if: steps.rewrite.outputs.changed == 'true' && inputs.dry_run != true |
| 108 | + env: |
| 109 | + GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }} |
| 110 | + run: | |
| 111 | + gh pr list --repo "${{ github.repository }}" --base gh-pages --state open \ |
| 112 | + --json number,headRefName \ |
| 113 | + --jq '.[] | select(.headRefName | startswith("automated/deploy/")) | .number' \ |
| 114 | + | while read -r number; do |
| 115 | + gh pr close "${number}" --repo "${{ github.repository }}" --delete-branch \ |
| 116 | + --comment "Closed because gh-pages was squashed. The next scheduled deploy reopens it on the new history." |
| 117 | + done |
| 118 | +
|
| 119 | + # The lease makes the push fail if anything landed on gh-pages since the |
| 120 | + # fetch, rather than dropping it. Re-run the workflow in that case. |
| 121 | + - name: Push rewritten gh-pages |
| 122 | + if: steps.rewrite.outputs.changed == 'true' && inputs.dry_run != true |
| 123 | + env: |
| 124 | + DEPLOY_KEY: ${{ secrets.GH_PAGES_DEPLOY_KEY }} |
| 125 | + run: | |
| 126 | + key="${RUNNER_TEMP}/gh-pages-deploy-key" |
| 127 | + hosts="${RUNNER_TEMP}/github-known-hosts" |
| 128 | + install -m 600 /dev/null "${key}" |
| 129 | + printf '%s\n' "${DEPLOY_KEY}" > "${key}" |
| 130 | + # GitHub's published host keys, fetched over TLS rather than trusted on first use. |
| 131 | + curl -fsSL https://api.github.com/meta | jq -r '.ssh_keys[] | "github.com " + .' > "${hosts}" |
| 132 | + GIT_SSH_COMMAND="ssh -i ${key} -o IdentitiesOnly=yes -o UserKnownHostsFile=${hosts} -o StrictHostKeyChecking=yes" git push \ |
| 133 | + --force-with-lease="refs/heads/gh-pages:${{ steps.rewrite.outputs.old }}" \ |
| 134 | + "git@github.com:${{ github.repository }}.git" \ |
| 135 | + refs/heads/gh-pages-squashed:refs/heads/gh-pages |
| 136 | + rm -f "${key}" |
0 commit comments