terraphim.ai/.github/workflows/validate.yml at main · terraphim/terraphim.ai · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
name: Validate site

# The site deploys to Cloudflare Pages from main only (.github/workflows/deploy.yml).
# This workflow is the pull-request gate: it proves the site builds, that every
# internal link resolves, and that the download URLs the site advertises match the
# public release channel. Without it a broken build would only surface at deploy
# time, after the merge.

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

env:
  ZOLA_VERSION: "0.22.1"

jobs:
  build:
    name: Build and check links
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Zola ${{ env.ZOLA_VERSION }}
        run: |
          curl --fail --location --silent --show-error \
            "https://github.com/getzola/zola/releases/download/v${ZOLA_VERSION}/zola-v${ZOLA_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
            | tar xz
          sudo mv zola /usr/local/bin
          zola --version

      - name: Build site
        # Zola fails the build on broken internal links.
        # This artifact is a test preview; production has its own deploy build.
        run: zola build --base-url http://127.0.0.1:8879

      - name: Verify editor, demo outputs and publication downloads
        run: python3 -m unittest discover -s scripts -p 'test_*.py' -v

      - name: Verify the build produced pages
        run: |
          pages=$(find public -name '*.html' | wc -l)
          echo "Generated ${pages} HTML pages"
          if [ "${pages}" -lt 10 ]; then
            echo "::error::Expected at least 10 generated pages, found ${pages}"
            exit 1
          fi
          test -f public/index.html || { echo "::error::public/index.html is missing"; exit 1; }

      - name: Upload site
        uses: actions/upload-artifact@v4
        with:
          name: site-public
          path: public/
          retention-days: 7

  navigation:
    name: Navigation (${{ matrix.browser }})
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        browser: [chromium, firefox, webkit]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: scripts/requirements-browser.txt

      - name: Download test preview
        uses: actions/download-artifact@v4
        with:
          name: site-public
          path: public

      - name: Install browser test tools
        run: |
          python -m pip install -r scripts/requirements-browser.txt
          python -m playwright install --with-deps ${{ matrix.browser }}

      - name: Verify responsive navigation and keyboard interactions
        run: |
          python -m http.server 8879 --bind 127.0.0.1 --directory public > /tmp/navigation-server.log 2>&1 &
          server_pid=$!
          trap 'kill "$server_pid"' EXIT
          curl --fail --silent --output /dev/null --retry 10 --retry-connrefused --retry-delay 1 --retry-max-time 20 http://127.0.0.1:8879/
          python scripts/check-navigation.py --base-url http://127.0.0.1:8879 --browser ${{ matrix.browser }} --artifacts navigation-results

      - name: Upload navigation evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: navigation-${{ matrix.browser }}
          path: navigation-results/
          retention-days: 7

  release-links:
    name: Check release channel links
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Verify advertised downloads exist on the public channel
        run: python3 scripts/check-release-links.py

  release-drift-check:
    name: Check release-link drift
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Detect drift between managed fields and admitted releases
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: python3 scripts/update_release.py --target website --check --receipt drift-receipt.json

      - name: Upload drift receipt
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: release-drift-receipt
          path: drift-receipt.json
          retention-days: 30