chore: bump version to 0.1.3 #21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pages | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| # Only one Pages deploy may be in-flight at once. | |
| concurrency: | |
| group: pages | |
| cancel-in-progress: true | |
| jobs: | |
| build-and-deploy: | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust + wasm32 target | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-unknown | |
| - name: Cache cargo | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install wasm-pack | |
| run: cargo install wasm-pack --locked | |
| - name: Build WASM bundle | |
| run: wasm-pack build --target web --out-dir web/ratdb/pkg -- --no-default-features --features rat_explorer | |
| - name: Configure Pages | |
| id: pages | |
| uses: actions/configure-pages@v5 | |
| - name: Build build_web_rocrate (release) | |
| # Datasets are no longer generated at deploy time; only the | |
| # top-level RO-Crate stitcher is needed here. | |
| run: cargo build --release --bin build_web_rocrate --features rat_explorer,dev-tools | |
| - name: Fetch RatDB dataset metadata | |
| # Datasets live in the tilezz-ratdb repo, one per orphan | |
| # branch, pinned by sha in web/ratdb/datasets.json. The deploy | |
| # copies each pinned ref's metadata (everything except | |
| # blocks/) into web/ratdb/data/<name>/ and points block_base_url | |
| # at the matching raw.githubusercontent.com URL, so the | |
| # explorer lazy-fetches blocks straight from the data repo | |
| # (CORS-verified) and manifest + URL can never drift apart. | |
| run: | | |
| jq -c '.[]' web/ratdb/datasets.json | while read -r ds; do | |
| name=$(jq -r .name <<<"$ds") | |
| repo=$(jq -r .repo <<<"$ds") | |
| ref=$(jq -r .ref <<<"$ds") | |
| mkdir -p "web/ratdb/data/$name" | |
| curl -sfL "https://api.github.com/repos/$repo/tarball/$ref" \ | |
| | tar -xz -C "web/ratdb/data/$name" --strip-components=1 \ | |
| --exclude='*/blocks' --exclude='*/blocks/*' | |
| base="https://raw.githubusercontent.com/$repo/$ref/blocks/" | |
| jq --arg base "$base" '. + {block_base_url: $base}' \ | |
| "web/ratdb/data/$name/block_index.json" > "/tmp/$name.manifest.json" | |
| mv "/tmp/$name.manifest.json" "web/ratdb/data/$name/block_index.json" | |
| done | |
| - name: Build top-level RO-Crate | |
| # Aggregate every web/ratdb/data/*/ro-crate-metadata.json into a | |
| # single web/ratdb/ro-crate-metadata.json. Crawlers (Google Dataset | |
| # Search) follow `<link rel=describedby>` from index.html | |
| # here; the explorer's JS reads `additionalProperty` from each | |
| # hasPart stub to drive ring -> dataset discovery without any | |
| # hardcoded paths. | |
| run: | | |
| # web/ratdb/ is published AS the Pages site root (see the | |
| # upload step), so the app lives at <base_url> directly. A | |
| # per-app custom domain (ratdb.app.pirogov.de) maps to the | |
| # site root -- it cannot point at a subdirectory -- so the app | |
| # must be at the root, not /ratdb/. | |
| ./target/release/build_web_rocrate \ | |
| --web-dir web/ratdb/ \ | |
| --page-url "${{ steps.pages.outputs.base_url }}" | |
| - name: Provenance gate (no -dirty / unknown in deployed crates) | |
| # Refuse to deploy if the app's OWN build commit (the aggregate | |
| # RO-Crate's #tilezz softwareVersion, stamped by build_web_rocrate) | |
| # or ANY served dataset's commit is non-pristine. A clean tag | |
| # checkout produces a bare 40-hex commit; a `-dirty` suffix or | |
| # `unknown` means a non-reproducible build slipped in -- never | |
| # publish that. Guarantees the live site records only clean | |
| # provenance. | |
| run: | | |
| python3 - <<'PY' | |
| import json, glob, re, sys | |
| HEX = re.compile(r'^[0-9a-f]{40}$') | |
| def software_version(path): | |
| meta = json.load(open(path)) | |
| return next((e.get("softwareVersion") | |
| for e in meta.get("@graph", []) | |
| if e.get("@id") == "#tilezz"), None) | |
| paths = ["web/ratdb/ro-crate-metadata.json", | |
| *sorted(glob.glob("web/ratdb/data/*/ro-crate-metadata.json"))] | |
| bad = [] | |
| for p in paths: | |
| v = software_version(p) | |
| ok = isinstance(v, str) and bool(HEX.match(v)) | |
| print(f"{p}: {v} {'OK' if ok else 'DIRTY/UNKNOWN'}") | |
| if not ok: | |
| bad.append(p) | |
| if bad: | |
| print("::error::non-pristine provenance, refusing to deploy: " + ", ".join(bad)) | |
| sys.exit(1) | |
| print("provenance gate: every deployed crate carries a clean commit") | |
| PY | |
| - name: Upload artifact | |
| uses: actions/upload-pages-artifact@v3 | |
| with: | |
| # Publish the ratdb app AS the site root so a custom domain | |
| # (ratdb.app.pirogov.de) resolves to it. The repo keeps apps in | |
| # sibling web/<app>/ dirs for organisation; each app deploys | |
| # from its own Pages site (one Pages site == one root). | |
| path: web/ratdb | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@v4 |