mirror of
https://github.com/backnotprop/plannotator.git
synced 2026-09-14 14:17:26 +08:00
Michael Ramos
64062af9a1
A Guided Review can now leave Plannotator: as a single self-contained HTML file that renders exactly like the in-app guide, as an encrypted-by-default share link on guides.show, or authored by any agent through the new guide CLI. Highlights: packages/guide-viewer extracted from review-editor at the injection seam (read-only host, no third renderer); guides.show Worker with R2-backed share storage, per-IP rate limiting on creation, delete tokens hashed at rest, and 128-bit ids; portable exports pin the viewer by SRI hash with budget and manifest gates in PR CI and at deploy; two-runtime parity across Bun and Pi verified; v0.27.x saved guides load unchanged. Retention is indefinite by explicit decision, to revisit with the lean sharing refactor. Decision record: adr/decisions/007-portable-guided-reviews-20260815.md
73 lines
2.6 KiB
YAML
73 lines
2.6 KiB
YAML
name: guides.show deploy
|
|
|
|
# Publishes the portable Guided Review viewer to guides.show. Runs on Plannotator
|
|
# release tags (decision record D10) so a viewer build == a Plannotator version,
|
|
# and on manual dispatch. Viewer files are add-only in R2 (D8): the deploy
|
|
# script refuses to overwrite an entry with different bytes and never deletes.
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v[0-9]+.[0-9]+.[0-9]+'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: guides-show-deploy
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
environment: production
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
|
with:
|
|
bun-version: 1.3.14
|
|
no-cache: true
|
|
|
|
- name: Install dependencies
|
|
run: bun install --frozen-lockfile
|
|
|
|
- name: Format compatibility (every shipped fixture parses) + worker tests
|
|
run: bun test ./packages/core/guide-format.test.ts ./apps/guides-show/worker ./apps/guides-show/share ./apps/guides-show/viewer
|
|
|
|
- name: Build viewer
|
|
run: bun run --cwd apps/guides-show build:viewer
|
|
|
|
- name: Size budgets
|
|
run: bun run --cwd apps/guides-show check:budgets
|
|
|
|
- name: Checked-in manifest matches this build
|
|
run: bun run --cwd apps/guides-show check:manifest
|
|
|
|
- name: Publish viewer files to R2 (add-only)
|
|
run: bun run --cwd apps/guides-show deploy:viewer
|
|
env:
|
|
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
|
|
|
- name: Deploy worker + landing
|
|
working-directory: apps/guides-show
|
|
run: bunx wrangler deploy
|
|
env:
|
|
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
|
|
|
- name: Smoke the published viewer entry
|
|
run: |
|
|
JS=$(bun -e "import { GUIDE_VIEWER_MANIFEST } from './packages/core/guide-viewer-manifest.ts'; console.log(GUIDE_VIEWER_MANIFEST.js)")
|
|
curl -fsSI "https://guides.show/v1/$JS" | tee /tmp/headers.txt
|
|
grep -qi 'cache-control: public, max-age=31536000, immutable' /tmp/headers.txt
|
|
grep -qi 'access-control-allow-origin: \*' /tmp/headers.txt
|
|
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: guides-show-viewer-manifest
|
|
path: apps/guides-show/dist/viewer/manifest.json
|