Skip to content

ci(pages): scoped auto-deploy of landing → gh-pages #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sgwannabe merged 1 commit into from
May 30, 2026
Merged

ci(pages): scoped auto-deploy of landing → gh-pages #42

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 58 additions & 0 deletions .github/workflows/deploy-landing.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
name: Deploy landing → gh-pages

# Publishes ONLY the landing files (index.html + assets/) from main onto the
# curated gh-pages branch.
#
# gh-pages is hand-assembled, NOT a mirror of main: it carries forge/, forms/,
# qdrant-features/, docs/, CNAME (memex.quest) and .nojekyll that do NOT exist
# on main. So this job is deliberately SCOPED — it only overlays index.html and
# assets/, and never deletes anything else. The "checkout from main" step is
# additive/update-only, so all curated content survives every deploy.

on:
push:
branches: [main]
paths:
- index.html
- assets/**
workflow_dispatch: {}

permissions:
contents: write

# Never run two deploys at once; queue them so a push is never interrupted.
concurrency:
group: deploy-landing-gh-pages
cancel-in-progress: false

jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Checkout (all branches, full history)
uses: actions/checkout@v4

@coderabbitai coderabbitai Bot May 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

액션을 SHA로 고정하여 보안 태세를 개선하세요.

현재 actions/checkout@v4는 변경 가능한 태그를 사용합니다. 공급망 공격을 방지하려면 특정 커밋 SHA로 고정하는 것이 권장됩니다.

🔒 SHA 고정 제안 
-      - name: Checkout (all branches, full history)
-        uses: actions/checkout@v4
+      - name: Checkout (all branches, full history)  
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 0

참고: 최신 v4 릴리스의 SHA를 확인하려면 actions/checkout 릴리스를 참조하세요.

🧰 Tools
🪛 zizmor (1.25.2)

[error] 33-33: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-landing.yml at line 33, The workflow currently uses
the mutable tag "uses: actions/checkout@v4"; replace that with the specific
commit SHA of the actions/checkout v4 release (e.g., "uses:
actions/checkout@<commit-sha>") to pin the action to an immutable reference and
improve supply-chain security—locate the correct SHA from the actions/checkout
releases page and update the line containing "uses: actions/checkout@v4"
accordingly.

with:
fetch-depth: 0

- name: Overlay index.html + assets/ onto gh-pages
run: |
set -euo pipefail
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

git switch gh-pages

# `git checkout <ref> -- <path>` writes ONLY the paths present in that
# ref's tree and never deletes files that exist solely on gh-pages.
# That makes this purely additive: forge/, forms/, qdrant-features/,
# docs/, CNAME and .nojekyll are left exactly as curated.
git checkout origin/main -- index.html assets

@chatgpt-codex-connector chatgpt-codex-connector Bot May 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Remove deleted assets when syncing landing

On a push that deletes or renames a file under assets/, this checkout runs in Git's default overlay mode (git checkout -h lists --[no-]overlay as default), so files that are absent from origin/main remain in the gh-pages worktree and git add index.html assets will not stage their deletion. The workflow will either publish only additions/updates or even report nothing to deploy for a deletion-only change, leaving removed landing assets still live on GitHub Pages; the sync needs a non-overlay checkout or an explicit removal of the landing assets/ tree before restoring it from main while still preserving unrelated curated directories.

Useful? React with 👍 / 👎.


git add index.html assets
if git diff --cached --quiet; then
echo "Landing already in sync with main — nothing to deploy."
exit 0
fi

git commit -m "deploy(landing): sync index.html + assets from ${GITHUB_SHA:0:7}"
git push origin gh-pages