From 89627b2e628b6db1749ec5ba22fbc32612b8230b Mon Sep 17 00:00:00 2001 From: Marcin Rataj Date: Fri, 17 Jul 2026 18:14:47 +0200 Subject: [PATCH] ci: publish website to github pages HTTP hosting for webui.ipfs.io and dev.webui.ipfs.io moves to GitHub Pages so the sites stay up independently of third-party gateway servers; IPFS pinning and DNSLink publishing are unchanged. - publishPreview: push build/ to ipfs/dev.webui.ipfs.io gh-pages on every main update (single orphan commit, ssh deploy key) - new deployPages job: on release dispatch, unpack the CAR artifact and deploy it to this repo's Pages, so served bytes always match the pinned CID; gated like the production dnslink step - gate pinning and publishing steps on github.repository so CI in forks skips them instead of failing on missing secrets - refresh stale comments about the release flow --- .github/workflows/ci.yml | 83 ++++++++++++++++++++++++++++++++++------ 1 file changed, 72 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index afb7f2ba0..39f87825d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -95,7 +95,7 @@ jobs: - name: Pin to web3.storage with w3cli id: pin-w3up # only pin for main commits - if: github.ref == 'refs/heads/main' + if: github.repository == 'ipfs/ipfs-webui' && github.ref == 'refs/heads/main' continue-on-error: true run: | # ensure whoami @@ -122,7 +122,7 @@ jobs: - name: Pin to ipfs-websites.collab.ipfscluster.io id: pin-cluster # only pin for main commits - if: github.ref == 'refs/heads/main' + if: github.repository == 'ipfs/ipfs-webui' && github.ref == 'refs/heads/main' continue-on-error: true timeout-minutes: 5 # pin should takes a few seconds, 5 min is a hard ceiling run: | @@ -169,26 +169,88 @@ jobs: # dnslink-dnsimple requires go - uses: actions/setup-go@v6 - if: github.ref == 'refs/heads/main' + if: github.repository == 'ipfs/ipfs-webui' && github.ref == 'refs/heads/main' with: go-version-file: '.tool-versions' - name: Set up dnslink updater - if: github.ref == 'refs/heads/main' + if: github.repository == 'ipfs/ipfs-webui' && github.ref == 'refs/heads/main' run: go install github.com/ipfs/dnslink-dnsimple@v0.1.0 # dev dnslink is updated on each main branch update - run: dnslink-dnsimple --domain ipfs.tech --record _dnslink.dev.webui --link /ipfs/${{ steps.ipfs.outputs.cid }} - if: github.ref == 'refs/heads/main' + if: github.repository == 'ipfs/ipfs-webui' && github.ref == 'refs/heads/main' env: DNSIMPLE_TOKEN: ${{ secrets.DNSIMPLE_TOKEN }} - # production dnslink is updated on release (during tag build) + # dev HTTP hosting: mirror build/ to the repo behind https://dev.webui.ipfs.io (GitHub Pages). + # force_orphan keeps that repo at a single commit; cname is required on every push because + # the orphan rewrite would otherwise drop the CNAME file that stores the custom domain. + - name: Publish build to ipfs/dev.webui.ipfs.io + if: github.repository == 'ipfs/ipfs-webui' && github.ref == 'refs/heads/main' + uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0 + with: + deploy_key: ${{ secrets.DEV_WEBUI_PAGES_DEPLOY_KEY }} + external_repository: ipfs/dev.webui.ipfs.io + publish_branch: gh-pages + publish_dir: ./build + cname: dev.webui.ipfs.io + force_orphan: true + full_commit_message: 'ipfs-webui@${{ github.sha }} /ipfs/${{ steps.ipfs.outputs.cid }}' + + # production dnslink is updated on release (workflow_dispatch on main) - run: dnslink-dnsimple --domain ipfs.tech --record _dnslink.webui --link /ipfs/${{ steps.ipfs.outputs.cid }} - if: github.ref == 'refs/heads/main' && github.event_name == 'workflow_dispatch' + if: github.repository == 'ipfs/ipfs-webui' && github.ref == 'refs/heads/main' && github.event_name == 'workflow_dispatch' env: DNSIMPLE_TOKEN: ${{ secrets.DNSIMPLE_TOKEN }} + # HTTP hosting for https://webui.ipfs.io (GitHub Pages, deployed via Actions). + # Gated exactly like the production dnslink update in publishPreview, so the Pages + # site and DNSLink always publish the same content in the same run. Bytes come + # from the CAR artifact (the only unconditional per-run copy of build/; the + # build artifact is skipped on cache hits), so served content matches the pinned CID. + deployPages: + name: deploy webui.ipfs.io (GitHub Pages) + needs: publishPreview + if: github.repository == 'ipfs/ipfs-webui' && github.ref == 'refs/heads/main' && github.event_name == 'workflow_dispatch' + runs-on: ubuntu-latest + permissions: + pages: write + id-token: write + environment: + name: github-pages + url: ${{ steps.deployment.outputs.page_url }} + concurrency: + group: pages-prod + cancel-in-progress: false + steps: + - name: Download CAR artifact + uses: actions/download-artifact@v7 + with: + name: ipfs-webui_${{ github.sha }}.car + + - uses: ipfs/download-ipfs-distribution-action@v1 + with: + name: kubo + + - name: Unpack CAR into build/ + run: | + ipfs init + ipfs dag import --pin-roots=false ipfs-webui_${{ github.sha }}.car + ipfs get ${{ needs.publishPreview.outputs.cid }} -o build + test -f build/index.html + # fail loudly if the unpacked tree does not match the CID that was pinned and DNSLinked + [ "$(ipfs add --cid-version 1 -Q -r -n ./build)" = "${{ needs.publishPreview.outputs.cid }}" ] + + - name: Upload Pages artifact + uses: actions/upload-pages-artifact@v5 + with: + path: build + + - name: Deploy to GitHub Pages + id: deployment + uses: actions/deploy-pages@v5 + test-e2e: name: 'test:e2e' uses: ./.github/workflows/test-e2e.yml @@ -257,10 +319,9 @@ jobs: echo " depcheck: ${{ steps.depcheck.outcome }}" exit 1 - # automatically commit new tag and changelog updates when a push to main happens. - # This will then trigger - # 1. The 'ci.yml' workflow for the newly committed git tag, - # 2. The 'publish-release-build.yml' workflow + # creates a GitHub Release with changelog and CAR file when ci.yml is manually + # dispatched on main; the release commit lands with [skip ci], so no follow-up + # workflow run is triggered by it release: name: 'Run semantic release' runs-on: ubuntu-latest