deploy.yml

name: Build and deploy portfolio

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '17 11 * * *'
  repository_dispatch:
    types: [remote-assets-updated]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: pages-${{ github.ref }}
  # Superseded pull request runs can stop early; a deploy from main must finish.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  check-remote-assets:
    if: github.event_name == 'schedule'
    runs-on: ubuntu-latest
    # Retries back off for about four minutes; anything longer is stuck, not recovering.
    timeout-minutes: 15
    outputs:
      changed: ${{ steps.assets.outputs.changed }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      # The fetcher uses only Node built-ins; unchanged days need no npm install.
      - name: Compare remote assets with the deployed snapshot
        id: assets
        run: npm run assets:check

  build:
    needs: check-remote-assets
    if: >-
      always() && !cancelled() &&
      (github.event_name != 'schedule' ||
      (needs.check-remote-assets.result == 'success' && needs.check-remote-assets.outputs.changed == 'true'))
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # Full history, so the sitemap's <lastmod> dates come from real commits.
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      # Dev tooling never reaches visitors, so only shipped dependencies gate the build.
      - run: npm audit --omit=dev --audit-level=high
      - run: npm run format:check
      - run: npm run lint
      - run: npm run check
      - run: npm run build
      - run: npm test
      # Flags a dead external link a pull request adds, without blocking it; the daily links
      # workflow tracks breakage on the live site.
      - name: Check external links
        if: github.event_name == 'pull_request'
        uses: lycheeverse/lychee-action@v2.9.0
        continue-on-error: true
        with:
          args: --no-progress --config lychee.toml --root-dir ${{ github.workspace }}/dist 'dist/**/*.html'
          checkbox: false
      - name: Install Playwright browsers
        run: npx playwright install --with-deps chromium firefox webkit
      # Playwright serves dist/ with astro preview and waits for it before testing. Firefox on
      # Linux creates a WebGL context only with an X display, so a virtual one lets the hero canvas
      # tests run in every engine (rendered in software by Mesa's llvmpipe).
      - name: Run browser and accessibility tests
        run: xvfb-run --auto-servernum npm run test:browser
      - name: Upload browser test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: browser-test-results
          path: test-results/
          retention-days: 7
      - uses: actions/upload-pages-artifact@v3
        if: github.event_name != 'pull_request'
        with:
          path: dist

  deploy:
    if: >-
      always() && !cancelled() && needs.build.result == 'success' &&
      github.event_name != 'pull_request'
    needs: build
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4

  # Confirms visitors get the new build, then checks the live site end to end. On scheduled runs
  # that deploy nothing, it still checks the site daily for certificate, DNS, or hosting problems.
  verify-live:
    needs: deploy
    if: >-
      always() && !cancelled() &&
      (needs.deploy.result == 'success' ||
      (github.event_name == 'schedule' && needs.deploy.result == 'skipped'))
    runs-on: ubuntu-latest
    # The CDN caches pages for ten minutes; the wait gives up after fifteen.
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      # The checker uses only Node built-ins, so no npm install.
      - name: Check the live site
        run: node scripts/verify-live.mjs
        env:
          EXPECTED_COMMIT: ${{ needs.deploy.result == 'success' && github.sha || '' }}