deploy.yml

name: Deploy Astro site to Pages

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write
  pages: write
  id-token: write

concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup mise (node + pnpm)
        uses: jdx/mise-action@v5

      - name: Locate pnpm store
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"

      - name: Cache pnpm store
        uses: actions/cache@v6
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Setup Pages
        uses: actions/configure-pages@v6

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Cache Astro build cache
        # node_modules/.astro holds the image service's transform cache
        # (~2500 avif/webp encodes, the dominant build cost) plus downloaded
        # fonts and the content-layer store. Keyed on sha so every run saves
        # its updated cache; restore-keys picks up the most recent one.
        uses: actions/cache@v6
        with:
          path: node_modules/.astro
          key: ${{ runner.os }}-astro-build-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-astro-build-

      - name: Lint
        run: pnpm run lint

      - name: Check formatting
        run: pnpm run format:check

      - name: Typecheck
        run: pnpm run typecheck

      - name: Run tests
        run: pnpm test

      - name: Publish to AT Protocol
        # Syndication failure (PDS/Bluesky outage) shouldn't block the site
        # deploy: the last-known-good .well-known publication file is tracked,
        # so the build still ships it, and the next run re-syncs from scratch.
        continue-on-error: true
        run: pnpm run atproto:publish
        env:
          ATP_IDENTIFIER: ${{ secrets.ATP_IDENTIFIER }}
          ATP_APP_PASSWORD: ${{ secrets.ATP_APP_PASSWORD }}
          # Announce newly-published posts to Bluesky. The back catalogue is
          # seeded in atproto-syndication.json, so only new posts are sent.
          BLUESKY_CROSSPOST: "1"

      - name: Build with Astro
        run: pnpm run build

      - name: Run integration tests
        run: pnpm run test:integration

      - name: Upload artifact
        uses: actions/upload-pages-artifact@v5
        with:
          path: dist
          # Default excludes all dotfiles (--exclude=.[^/]*), which drops the
          # .well-known/ directory from the artifact and 404s the Standard.site
          # publication verification. Keep hidden files.
          include-hidden-files: true

      - name: Commit state changes
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add atproto-state.json atproto-syndication.json public/.well-known/site.standard.publication
          git diff --staged --quiet || (git commit -m "[skip ci] update atproto state" && git push)

  deploy:
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v5