[GRASS-git] [OSGeo/grass-website] 2dcd93: Split production artifact workflow into build and ...

[Corey White]

  Branch: refs/heads/master
  Home:   https://github.com/OSGeo/grass-website
  Commit: 2dcd930c7fb59830e9a5a391a4c639ccd620dae8
      https://github.com/OSGeo/grass-website/commit/2dcd930c7fb59830e9a5a391a4c639ccd620dae8
  Author: Corey White <smortopahri at gmail.com>
  Date:   2026-07-15 (Wed, 15 Jul 2026)

  Changed paths:
    A .github/workflows/additional_checks.yml
    M .github/workflows/build-production-site.yml
    A .github/workflows/post-pr-reviews.yml
    A .markdownlint.yml
    A .pre-commit-config.yaml
    A .yamllint
    M archetypes/default.md
    M config.toml
    M data/grass.json
    M data/team.yml
    M renovate.json
    M static/files/GRASSNews_vol3_erratum.txt
    M static/files/grass_osgeo_erratum.txt
    M static/files/grass_osgeo_news4.bib
    M static/files/grassnews3.bib
    M static/images/gallery/raster/water-flow-with-simwe.txt
    M static/images/gallery/vector/nyc-population-density.txt
    M static/images/news/README.md
    A zizmor.yml

  Log Message:
  -----------
  Split production artifact workflow into build and deploy jobs (#646)

* ci: split production workflow into build and deploy jobs

The build job produces and checksums the tarball and hands it to the
deploy job as a short-lived workflow artifact; deploy (needs: build)
re-verifies the checksum and publishes to the rolling release. A failed
build can no longer reach the publish step, and only the deploy job
holds a writable token (the build job is read-only).

* ci: run zizmor on workflows via zizmor-action

Runs on pushes to master and on pull requests; findings upload as
SARIF to code scanning. The current hugo.yml findings it will surface
are already fixed on the #599 branch.

* ci: run the build job on pull requests as a merge gate

Pull requests build the site exactly like master pushes but skip the
deploy job, so a broken build is caught before merge and publishing
still only happens from master. Concurrency is scoped per ref so PR
builds cannot cancel an in-flight master deployment.

* ci: never cancel a running publish; gate deploys on freshness

Adopt the concurrency doctrine from grass core's docker.yml: cancel
in-progress runs only for pull requests, while pushes queue with one
running and only the newest queued run kept. A running publish is never
killed mid-upload, and the deploy job now checks that its commit is
still the head of the triggering ref before publishing, so the newest
commit always wins regardless of run duration.

* ci: enforce pre-commit hooks like grass core and grass-addons

Add .pre-commit-config.yaml (whitespace/EOF fixers, markdownlint,
yamllint, actionlint, zizmor) with the same tool set and configs as the
sibling repos, adapted excludes for Hugo templates and the legacy
content that the open migration stack (#599, #644, #645) rewrites.
Enforce it in CI with the grass-addons Additional Checks workflow
(prek) and post fixable diffs as PR review suggestions via
post-pr-reviews. The standalone zizmor workflow is superseded by the
pre-commit zizmor hook; zizmor.yml carries temporary ignores for the
pre-migration hugo.yml that clear when #599 merges. Renovate is told
not to pin the create-upload-suggestions action, which is maintained
in the main repo at @main.

* style: apply pre-commit fixes

Automatic trailing-whitespace, end-of-file, and markdownlint fixes on
files outside the open migration stack's footprint.

* ci: restrict publishing to master and gate it with an environment

The push trigger already limited deploys to master, but a manual
dispatch on any branch could still publish. The deploy job now requires
the master ref explicitly, and it deploys through a production
environment so repository settings can add platform-level enforcement:
a deployment branch policy allowing only master, and required-reviewer
approvals if wanted. The environment also records deployment history
pointing at grass.osgeo.org.

* ci: publish per-deploy versioned releases with retention and rollback

Replace the single clobbered 'production' release with a per-deploy
release tagged site-<date>-<sha>, marked as latest. The server switches
to the releases/latest/download shortcut, so rollback is re-marking an
older release as latest and there is always a short history of known
builds. A prune step keeps the newest 10 plus any pinned with [keep] in
the title, bounding total asset storage. Each release is immutable
(assets are never overwritten), addressing possible future immutable-
release enforcement. Addresses echoix's release-history review comment.



To unsubscribe from these emails, change your notification settings at https://github.com/OSGeo/grass-website/settings/notifications