docs.yml

name: Python developer portal

on:
  push:
    branches: [main]
    paths:
      - 'src/**'
      - 'docs/**'
      - 'overrides/**'
      - 'mkdocs.yml'
      - 'pyproject.toml'
      - 'scripts/check-docs-analytics.py'
      - 'scripts/check-docs-layout.py'
      - 'scripts/docstring_cross_references.py'
      - '.github/workflows/docs.yml'
  workflow_dispatch:
    inputs:
      stable_tag:
        description: 'Published stable SDK tag to deploy, or empty for current main'
        type: string
        required: false

permissions:
  contents: read

concurrency:
  group: python-developer-portal
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      stable: ${{ steps.release-channel.outputs.stable }}
    steps:
      - name: Validate the selected stable tag
        if: inputs.stable_tag != ''
        env:
          STABLE_TAG: ${{ inputs.stable_tag }}
        run: |
          if [[ ! "$STABLE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo 'stable_tag must name an exact stable SDK version' >&2
            exit 1
          fi
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
        with:
          ref: ${{ (inputs.stable_tag != '' && format('refs/tags/{0}', inputs.stable_tag)) || github.sha }}
          fetch-depth: 0
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Resolve the public documentation release channel
        id: release-channel
        env:
          STABLE_TAG: ${{ inputs.stable_tag }}
          GH_TOKEN: ${{ github.token }}
        run: |
          version=$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')
          if [ -n "$STABLE_TAG" ]; then
            test "$version" = "$STABLE_TAG"
            test "$(gh release view "$STABLE_TAG" --repo "$GITHUB_REPOSITORY" --json isDraft,isPrerelease --jq '(.isDraft == false and .isPrerelease == false)')" = true
            test "$(git rev-parse HEAD)" = "$(git rev-parse "refs/tags/$STABLE_TAG^{commit}")"
          fi
          if [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo stable=true >> "$GITHUB_OUTPUT"
          else
            echo stable=false >> "$GITHUB_OUTPUT"
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
      - name: Bootstrap patched pip trust
        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
        with:
          clients: pip,python
      - name: Install package and documentation dependencies
        run: pip install -e '.[docs]'
      - name: Install Chromium
        env:
          NODE_OPTIONS: --use-openssl-ca
          NODE_EXTRA_CA_CERTS: ''
          NODE_USE_SYSTEM_CA: '0'
          NODE_TLS_REJECT_UNAUTHORIZED: '1'
        run: python -m playwright install --with-deps chromium
      - name: Build and check the portal
        env:
          CLOUDFLARE_WEB_ANALYTICS_TOKEN: ${{ vars.CLOUDFLARE_WEB_ANALYTICS_TOKEN }}
        run: |
          if ! printf '%s' "$CLOUDFLARE_WEB_ANALYTICS_TOKEN" | grep -Eq '^[a-f0-9]{32}$'; then
            echo 'CLOUDFLARE_WEB_ANALYTICS_TOKEN must be the canonical 32-character site token' >&2
            exit 1
          fi
          sed -i "s/__CLOUDFLARE_WEB_ANALYTICS_TOKEN__/$CLOUDFLARE_WEB_ANALYTICS_TOKEN/" \
            docs/javascripts/analytics.js
          mkdocs build --strict
          python scripts/docstring_cross_references.py --site site
          python scripts/check-docs-analytics.py site --require-token
          python scripts/check-docs-layout.py site
          test -s site/index.html
          test "$(cat site/CNAME)" = "python.durable-workflow.com"
      - name: Bind Pages artifact to the exact source revision
        env:
          SDK_VERSION: ${{ steps.release-channel.outputs.version }}
        run: |
          SOURCE_REVISION=$(git rev-parse HEAD)
          export SOURCE_REVISION
          python - <<'PY'
          import json
          import os
          from pathlib import Path

          Path("site/deployment-audit.json").write_text(json.dumps({
              "schema": "durable-workflow.sdk-python.docs-deployment/v1",
              "source_revision": os.environ["SOURCE_REVISION"],
              "sdk_version": os.environ["SDK_VERSION"],
          }) + "\n")
          PY
      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5
        if: github.server_url == 'https://github.com'
        with:
          path: site

  deploy:
    if: >-
      github.server_url == 'https://github.com' &&
      github.ref == 'refs/heads/main' &&
      needs.build.outputs.stable == 'true'
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      pages: write
    environment:
      name: github-pages
      url: https://python.durable-workflow.com/
    steps:
      - id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128  # v5