ci.yml

name: ci

concurrency:
  cancel-in-progress: ${{ ! startsWith(github.ref, 'refs/tags/v') }}
  group: ci-${{ github.ref_name }}-${{ github.event_name }}

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
permissions:
  contents: write

env:
  NETLIFY_SITE_ID: developer-friendly
  NETLIFY_DEPLOY_TO_PROD: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
  PYTHON_VERSION: 3.x

jobs:
  build:
    if: github.event_name == 'pull_request'
    permissions:
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Calculate cache id
        run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
      - name: Cache mkdocs-material
        uses: actions/cache@v4
        with:
          key: mkdocs-material-${{ env.cache_id }}
          path: .cache
          restore-keys: |
            mkdocs-material-
      - env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
        name: Install dependencies
        run: |
          pip install -U pip -r requirements.txt
          sudo apt-get install -y libcairo2-dev libfreetype6-dev libffi-dev libjpeg-dev libpng-dev libz-dev pngquant
      - env:
          DRAFT: ${{ github.event_name == 'pull_request' }}
          GA_PROPERTY: ${{ vars.GA_PROPERTY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # git-committers plugin
        name: Build the site
        run: mkdocs build
      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@v3
        with:
          name: build-pr${{ github.event.pull_request.number }}
          path: site
      - id: netlify
        name: Deploy to Netlify
        uses: jsmrcaga/action-netlify-deploy@v2.1.0
        with:
          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
          NETLIFY_DEPLOY_TO_PROD: ${{ env.NETLIFY_DEPLOY_TO_PROD }}
          NETLIFY_SITE_ID: ${{ env.NETLIFY_SITE_ID }}
          build_command: echo Skipping building the web files
          build_directory: site
          install_command: echo Skipping installing the dependencies
      - name: Comment PR
        uses: meysam81/comment-pr@main
        with:
          title: "# Live preview"
          content: |
            The live preview of the changes are available at the following URL:
            <${{ env.NETLIFY_PREVIEW_URL }}>
          token: ${{ secrets.GITHUB_TOKEN }}

  deploy:
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      id-token: write
      pages: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Configure Git Credentials
        run: |
          git config user.name ${{ github.actor }}
          git config user.email ${{ github.actor }}@users.noreply.github.com
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Calculate cache id
        run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
      - name: Cache mkdocs-material
        uses: actions/cache@v4
        with:
          key: mkdocs-material-${{ env.cache_id }}
          path: .cache
          restore-keys: |
            mkdocs-material-
      - env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
        name: Install dependencies
        run: |
          pip install -U pip -r requirements.txt
          sudo apt-get install -y libcairo2-dev libfreetype6-dev libffi-dev libjpeg-dev libpng-dev libz-dev pngquant
      - env:
          GA_PROPERTY: ${{ vars.GA_PROPERTY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        name: Build the site
        run: mkdocs build
      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: site
      - id: deployment
        name: Deploy to GitHub Pages
        uses: actions/deploy-pages@v4
      - id: netlify
        name: Deploy to Netlify
        uses: jsmrcaga/action-netlify-deploy@v2.1.0
        with:
          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
          NETLIFY_DEPLOY_TO_PROD: ${{ env.NETLIFY_DEPLOY_TO_PROD }}
          NETLIFY_SITE_ID: ${{ env.NETLIFY_SITE_ID }}
          build_command: echo Skipping building the web files
          build_directory: site
          install_command: echo Skipping installing the dependencies

  lychee:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - id: lychee
        name: Link Checker
        uses: lycheeverse/lychee-action@v1
        with:
          fail: ${{ github.ref == 'refs/heads/main' }}
      - if: env.lychee_exit_code != 0
        name: Create Issue From File
        uses: peter-evans/create-issue-from-file@v5
        with:
          content-filepath: ./lychee/out.md
          labels: report, automated issue

  trivy:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        scan-type:
          - fs
          - config
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Trivy ${{ matrix.scan-type }}
        uses: aquasecurity/trivy-action@master
        with:
          exit-code: "1"
          scan-ref: .
          scan-type: ${{ matrix.scan-type }}
          trivy-config: trivy.yaml