postgresql-jdbc.git / summary / log / commit / refs
commit 4821ea19f12ee7900a3301d36bbc3206109caecd
Author: Sehrope Sarkuni <sehrope@jackdb.com>
Date: Tue Oct 27 01:41:47 2026 +0000
ci: deploy the site to S3 and CloudFront
The site moves from GitHub Pages to an S3 bucket behind CloudFront.
docs.yml now only builds the site and uploads it as the site artifact,
on pull requests too. docs-deploy.yml replaces the placeholder with a
workflow that calls it and then deploys, so only the deploy workflow
holds the AWS role.
Each deploy replaces the contents of the bucket with the built site and
then invalidates the CloudFront cache. The new files are uploaded
first and the files that are no longer in the site are deleted after,
so a page that moved is still served while the upload runs.
The deploy runs only when started by hand on the www-release branch. A
run on any other branch fails with an error before it builds the site,
so starting the workflow on the wrong branch cannot replace the site.
The release: published trigger never fired for releases that
release.yml publishes with GITHUB_TOKEN.
.github/workflows/docs-deploy.yml | 77 +++++++++++++++++++++++++++++++++++++--
.github/workflows/docs.yml | 40 +++-----------------
CONTRIBUTING.md | 6 ++-
3 files changed, 83 insertions(+), 40 deletions(-)
diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml
index 96a2a48a..facb1c2a 100644
--- a/.github/workflows/docs-deploy.yml
+++ b/.github/workflows/docs-deploy.yml
@@ -6,11 +6,80 @@ on:
permissions:
contents: read
+defaults:
+ run:
+ shell: bash --noprofile --norc -euo pipefail {0}
+
+# A newly queued run cancels a pending run in the same group, so only
+# www-release runs, which deploy, share the site group.
+concurrency:
+ group: >-
+ ${{ github.ref == 'refs/heads/www-release' && 'site'
+ || format('docs-deploy-{0}', github.ref) }}
+ cancel-in-progress: false
+
jobs:
+ check-branch:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Check the branch
+ run: |
+ if [[ "${GITHUB_REF}" != refs/heads/www-release ]]; then
+ echo "::error::The site deploys only from the www-release branch, not from ${GITHUB_REF}."
+ exit 1
+ fi
+
+ build:
+ needs: check-branch
+ uses: ./.github/workflows/docs.yml
+
deploy:
+ needs: build
+ permissions:
+ contents: read
+ id-token: write
runs-on: ubuntu-latest
steps:
- # Placeholder so that GitHub registers the workflow and it can be started
- # on another branch. The real deploy replaces this.
- - name: Placeholder
- run: "false"
+ - name: Download artifact
+ uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+ with:
+ name: site
+ path: ./public
+
+ - name: Configure AWS credentials
+ uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
+ with:
+ role-to-assume: ${{ vars.SITE_AWS_ROLE_ARN }}
+ aws-region: ${{ vars.SITE_AWS_REGION }}
+
+ - name: Upload the site to S3
+ env:
+ BUCKET: ${{ vars.SITE_S3_BUCKET }}
+ run: |
+ aws s3 sync \
+ ./public \
+ "s3://${BUCKET}/" \
+ --no-follow-symlinks \
+ --no-progress
+
+ # Deleting in a second pass keeps a page that moved available while the
+ # new files upload.
+ - name: Delete the files that are no longer in the site
+ env:
+ BUCKET: ${{ vars.SITE_S3_BUCKET }}
+ run: |
+ aws s3 sync \
+ ./public \
+ "s3://${BUCKET}/" \
+ --delete \
+ --no-follow-symlinks \
+ --no-progress
+
+ - name: Invalidate the CloudFront cache
+ env:
+ DISTRIBUTION_ID: ${{ vars.SITE_CLOUDFRONT_DISTRIBUTION_ID }}
+ run: |
+ aws cloudfront create-invalidation \
+ --distribution-id "${DISTRIBUTION_ID}" \
+ --paths '/*' \
+ --output text
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 016d8edd..2386a057 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -1,32 +1,22 @@
-name: Deploy Hugo Docs
+name: docs
on:
- release:
- types: [published]
pull_request:
paths:
- 'docs/**'
- '.github/workflows/docs.yml'
- '.github/workflows/docs-deploy.yml'
- workflow_dispatch:
+ workflow_call:
permissions:
contents: read
concurrency:
- group: >-
- ${{ github.event_name == 'pull_request'
- && format('docs-pr-{0}', github.event.pull_request.number)
- || 'pages' }}
+ group: docs-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
build:
- # Setup Pages reads the Pages site through the REST API, which needs
- # pages: read. Pull request runs skip that step.
- permissions:
- contents: read
- pages: read
runs-on: ubuntu-latest
steps:
- name: Checkout
@@ -47,10 +37,6 @@ jobs:
rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
.github/workflows/docs.yml .github/workflows/docs-deploy.yml
- - name: Setup Pages
- if: github.event_name != 'pull_request'
- uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
-
- name: Build
env:
BASE_URL: ${{ vars.SITE_BASE_URL || 'https://jdbc.postgresql.org/' }}
@@ -58,22 +44,8 @@ jobs:
working-directory: ./docs
- name: Upload artifact
- if: github.event_name != 'pull_request'
- uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
+ name: site
path: ./docs/public
-
- deploy:
- if: github.event_name != 'pull_request'
- permissions:
- pages: write
- id-token: write
- environment:
- name: github-pages
- url: ${{ steps.deployment.outputs.page_url }}
- runs-on: ubuntu-latest
- needs: build
- steps:
- - name: Deploy to GitHub Pages
- id: deployment
- uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5
+ retention-days: 7
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a0b86561..4cf6efc4 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -226,8 +226,10 @@ The build fails when:
- A release changelog has no `date`.
- No changelog file sets a release `version`.
-A pull request that changes `docs/` runs this build. To see the pages before you open the pull request, run
-`hugo server` in `docs/`.
+A pull request that changes `docs/` runs this build and uploads the built site as the `site` artifact of the run.
+The links in it are relative to the site root, so serve the unzipped directory with `python3 -m http.server`
+rather than opening the files directly. To see the pages before you open the pull request, run `hugo server` in
+`docs/`.
## Dependencies
[parent: 57a1499d86eb]