ermnvldmr.com/.gitea/workflows/services-docs-next-required.yml

name: services/docs - next/required
'on':
  push:
    branches:
    - next
    paths:
    - services/docs/**
    - .gitea/workflows/services-docs-next-required.yml
    - ci/docker/docs/**
    - ci/config/nginx/**
    - ci/scripts/**
    - .gitea/scripts/**
    - .gitea/actions/**
concurrency:
  group: ci-docs-${{ github.ref_name }}
  cancel-in-progress: true
permissions:
  contents: read
  actions: read
jobs:
  setup-hugo:
    name: Setup - Hugo
    runs-on: apex-debian13
    steps:
    - name: Checkout repository
      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: recursive
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ${{ secrets.HEXTRA_READ_KEY }}
    - name: Setup Hugo
      run: hugo version | grep extended
  build-hugo:
    name: Build - Hugo Site
    needs: setup-hugo
    runs-on: apex-debian13
    steps:
    - name: Checkout repository
      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: recursive
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ${{ secrets.HEXTRA_READ_KEY }}
    - name: Setup Hugo
      run: hugo version | grep extended
    - name: Build Hugo site
      working-directory: services/docs
      run: hugo --gc --minify
  release-docker:
    name: Release - Docker Image
    needs: build-hugo
    runs-on: apex-debian13
    permissions:
      contents: read
      packages: write
    steps:
    - name: Checkout repository
      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: recursive
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ${{ secrets.HEXTRA_READ_KEY }}
    - name: Log in to GitHub Container Registry
      run: python3 .gitea/scripts/docker.py login
      env:
        REGISTRY: git.ermnvldmr.com
        REGISTRY_USER: ${{ github.repository_owner }}
        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
    - name: Extract Docker metadata
      id: meta
      run: python3 .gitea/scripts/docker.py metadata
      env:
        IMAGES: git.ermnvldmr.com/${{ github.repository }}/docs
        TAG_RULES: 'type=raw,value=latest

          type=sha,format=short

          '
        SOURCE_SHA: ${{ github.sha }}
    - name: Compute short SHA
      id: vars
      run: echo "short_sha=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
    - name: Build and push Docker image
      run: python3 .gitea/scripts/docker.py build
      env:
        TAGS: ${{ steps.meta.outputs.tags }}
        LABELS: ${{ steps.meta.outputs.labels }}
        BUILD_ARGS: 'COMMIT_SHA=${{ steps.vars.outputs.short_sha }}

          VERSION=${{ steps.vars.outputs.short_sha }}

          '
        DOCKERFILE: ci/docker/docs/Dockerfile
        PLATFORMS: ''
        PUSH: 'true'
        CONTEXT: .
        SOURCE_SHA: ${{ github.sha }}
        RUN_ID: ${{ github.run_id }}
  deploy:
    name: Deploy - Kubernetes (GitOps)
    needs: release-docker
    runs-on: apex-debian13
    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
    permissions:
      contents: write
    steps:
    - name: Checkout repository
      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
      env:
        CHECKOUT_REF: ${{ github.sha }}
        CHECKOUT_SUBMODULES: 'false'
        CHECKOUT_TOKEN: ${{ github.token }}
        PERSIST_CREDENTIALS: 'false'
        HEXTRA_READ_KEY: ''
    - name: Setup Kustomize
      run: test "$(kustomize version)" = v5.3.0
    - name: Deploy via GitOps
      run: 'DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"

        bash ci/scripts/deploy-gitops.sh docs "${DOCS_TAG}"

        '
      env:
        GIT_WRITE_KEY: ${{ secrets.DOCS_DEPLOY_KEY }}
  verify-rollout:
    name: Verify - Production Rollout
    needs: deploy
    runs-on: apex-debian13
    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
    steps:
    - name: Await production rollout
      run: "TARGET_COMMIT=\"sha-$(echo ${{ github.sha }} | cut -c1-7)\"\nENDPOINT=\"\
        https://docs.ermnvldmr.com/version.json\"\n\necho \"========================================================\"\
        \necho \"Verifying production deployment on $ENDPOINT\"\necho \"Expected commit:\
        \ $TARGET_COMMIT\"\necho \"========================================================\"\
        \n\nMAX_ATTEMPTS=45\nATTEMPT=1\nCF_BLOCKED_COUNT=0\n\nwhile [ $ATTEMPT -le\
        \ $MAX_ATTEMPTS ]; do\n  echo \"Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT...\"\
        \n\n  RESP_FILE=$(mktemp)\n  HTTP_CODE=$(curl -sL --max-time 10 \\\n    -H\
        \ \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\
        \ (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" \\\n    -H \"Accept:\
        \ application/json\" \\\n    -o \"$RESP_FILE\" \\\n    -w \"%{http_code}\"\
        \ \\\n    \"$ENDPOINT\" || echo \"000\")\n\n  if [ \"$HTTP_CODE\" = \"200\"\
        \ ]; then\n    LIVE_COMMIT=$(jq -r '.commit // empty' \"$RESP_FILE\" 2>/dev/null\
        \ || true)\n    echo \"  Live commit: ${LIVE_COMMIT:-<none>}\"\n\n    if [\
        \ \"$LIVE_COMMIT\" = \"$TARGET_COMMIT\" ]; then\n      echo \"\u2705 Success!\
        \ Production docs has successfully rolled out $TARGET_COMMIT.\"\n      rm\
        \ -f \"$RESP_FILE\"\n      exit 0\n    fi\n  elif [ \"$HTTP_CODE\" = \"403\"\
        \ ] || [ \"$HTTP_CODE\" = \"503\" ]; then\n    echo \"  HTTP $HTTP_CODE: Cloudflare\
        \ WAF/challenge encountered from runner IP.\"\n    CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT\
        \ + 1))\n  else\n    echo \"  HTTP $HTTP_CODE: Endpoint returned unexpected\
        \ status code or timed out.\"\n  fi\n\n  rm -f \"$RESP_FILE\"\n\n  if [ $CF_BLOCKED_COUNT\
        \ -ge 5 ]; then\n    echo \"\u26A0\uFE0F Cloudflare WAF consistently blocked\
        \ external probe requests from this runner IP (HTTP $HTTP_CODE).\"\n    echo\
        \ \"The GitOps release commit was already pushed to the repository; FluxCD\
        \ will reconcile the cluster.\"\n    echo \"Skipping further external HTTP\
        \ verification to avoid false negative.\"\n    exit 0\n  fi\n\n  ATTEMPT=$((ATTEMPT\
        \ + 1))\n  sleep 10\ndone\n\necho \"\u274C Deployment verification timed out\
        \ after 7.5 minutes.\"\nexit 1\n"