From 065a23ac3017b708d5f82e80e138cbd8d0d21009 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 19 Jun 2026 16:41:33 +0000 Subject: [PATCH 1/2] Initial plan From 2bc6a85295ae61b36481b328e6348abeaf1031bd Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 19 Jun 2026 16:45:44 +0000 Subject: [PATCH 2/2] Fix check-deploy-branch heredoc terminator indentation --- .github/workflows/publish.yaml | 122 +++++++++++++++++++++------------ 1 file changed, 79 insertions(+), 43 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index aa1f935c0..01ab4dbd9 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -1,15 +1,18 @@ name: Deploy Rendered Site on: + workflow_dispatch: push: - branches: [ main ] + branches: + - '**' env: CARGO_TERM_COLOR: always # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages permissions: - contents: write + actions: read + contents: read pages: write id-token: write @@ -21,62 +24,95 @@ concurrency: cancel-in-progress: false jobs: + check-deploy-branch: + runs-on: ubuntu-latest + outputs: + should_deploy: ${{ steps.branch-policy.outputs.should_deploy }} + steps: + - name: Evaluate github-pages deployment branch policy + id: branch-policy + shell: bash + env: + GITHUB_TOKEN: ${{ github.token }} + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_REF_NAME: ${{ github.ref_name }} + GITHUB_REF_PROTECTED: ${{ github.ref_protected }} + GITHUB_EVENT_NAME: ${{ github.event_name }} + run: | + if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then + echo "should_deploy=true" >> "${GITHUB_OUTPUT}" + exit 0 + fi + + env_response="$( + GH_TOKEN="${GITHUB_TOKEN}" gh api \ + -H "Accept: application/vnd.github+json" \ + "/repos/${GITHUB_REPOSITORY}/environments/github-pages" + )" + + custom_branch_policies="$( + python -c 'import json,sys; print(str(json.loads(sys.stdin.read()).get("deployment_branch_policy", {}).get("custom_branch_policies", False)).lower())' \ + <<< "${env_response}" + )" + + protected_branches_only="$( + python -c 'import json,sys; print(str(json.loads(sys.stdin.read()).get("deployment_branch_policy", {}).get("protected_branches", False)).lower())' \ + <<< "${env_response}" + )" + + if [ "${custom_branch_policies}" = "true" ]; then + policy_response="$( + GH_TOKEN="${GITHUB_TOKEN}" gh api \ + -H "Accept: application/vnd.github+json" \ + "/repos/${GITHUB_REPOSITORY}/environments/github-pages/deployment-branch-policies?per_page=100" + )" + + if POLICY_RESPONSE="${policy_response}" BRANCH_NAME="${GITHUB_REF_NAME}" python - <<'PY' + import fnmatch + import json + import os + import sys + + branch = os.environ["BRANCH_NAME"] + policies = json.loads(os.environ["POLICY_RESPONSE"]).get("branch_policies", []) + for policy in policies: + name = policy.get("name") + if name and fnmatch.fnmatch(branch, name): + sys.exit(0) + sys.exit(1) + PY + then + echo "should_deploy=true" >> "${GITHUB_OUTPUT}" + else + echo "should_deploy=false" >> "${GITHUB_OUTPUT}" + fi + elif [ "${protected_branches_only}" = "true" ]; then + if [ "${GITHUB_REF_PROTECTED}" = "true" ]; then + echo "should_deploy=true" >> "${GITHUB_OUTPUT}" + else + echo "should_deploy=false" >> "${GITHUB_OUTPUT}" + fi + else + echo "should_deploy=true" >> "${GITHUB_OUTPUT}" + fi + render-and-deploy: + needs: check-deploy-branch + if: needs.check-deploy-branch.outputs.should_deploy == 'true' runs-on: ubuntu-latest steps: - - name: Generate app token - id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 - with: - client-id: ${{ secrets.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} - - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: publish fetch-depth: 0 - token: ${{ steps.app-token.outputs.token }} - - - name: Verify nonexistence of `base_ref` - shell: bash - run: | - if [ -e base_ref ]; then exit 1; fi - - - name: Set base ref - run: | - git show --format=%H --no-notes --no-patch 'HEAD' -- |tee base_ref - if ! ( grep -E '^[0-9a-f]{40}$' base_ref ); then exit 1; fi - name: Setup Pages uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - - name: Merge `main` to the `publish` branch - run: | - set -x - git config --global user.name 'github_actions' - git config --global user.email 'actions@github.com' - version="$(git describe --tags --abbrev=6 origin/main |sed 's/-1-g.*//')" - # Merge preferring the version in main. - git merge -s recursive -Xtheirs origin/main --commit -m 'Auto-deploy: merging "main" branch' - # Apply a tag to the merge commit, otherwise the uses of `git describe` in `protocol/Makefile` - # won't find it. Any existing tag of the same name will be overwritten. - git tag -f "${version}-auto" - - name: Compile ZIPs and Zcash Protocol Specification uses: ./.github/actions/render - - name: Set `.gitignore` to not ignore `rendered/` - # This needs to be afer rendering so that it is not considered to make the tree dirty. - run: sed -i 's@^rendered/$@@' .gitignore - - - name: Commit and push to `publish` branch - uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321 # v10.0.0 - with: - add: 'rendered' - default_author: github_actions - - name: Upload artifact uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: