pages.yml

name: Build and Deploy

on:
  push:
    branches:
      - '**'       # matches all branches
      - '!gh-pages'  # excludes gh-pages

permissions:
  contents: write
  pages: write

# Serialize deploys to gh-pages. Concurrent master pushes race the
# JamesIves force-push (cannot lock ref) — run 35056225053 failed at
# 2026-09-16T04:38Z while the next SHA's deploy succeeded 9s later.
# GitHub does not guarantee FIFO ordering within a concurrency group, so
# the deploy step also verifies that this run still targets the ref head.
concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

jobs:
  build-and-deploy:
    name: Build and deploy (ruby-${{ matrix.ruby_version }})
    runs-on: ubuntu-latest
    strategy:
      matrix:
        ruby_version: ['3.3']
    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      # Tree-wide: a link to an unpublished (public: false) post 404s live.
      - name: Check internal blog links
        run: |
          python3 scripts/precommit/check_internal_blog_links.py

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: ${{ matrix.ruby_version }}
          bundler-cache: true

      - name: Install dependencies
        run: |
          sudo npm install --global pug pug-cli
          make install-deps

      - name: Build
        run: |
          make build

      # Playwright 1.60 cannot install browsers on the ubuntu-latest image
      # (26.04), so the landing spec drives the runner's preinstalled Chrome.
      - name: Check landing at 390px and 1440px in light and dark
        run: |
          chrome="$(command -v google-chrome || true)"
          if [ -z "$chrome" ]; then
            echo "::error::google-chrome is not on this runner image; the landing check cannot run"
            exit 1
          fi
          PLAYWRIGHT_EXECUTABLE_PATH="$chrome" npx playwright test --reporter=line

      - name: Check deployment is current
        id: deploy-check
        if: github.ref == 'refs/heads/master'
        run: |
          python3 scripts/check_deploy_is_current.py \
            --repository "${{ github.repository }}" \
            --ref "heads/master" \
            --run-sha "${{ github.sha }}" \
            --token "${{ github.token }}" \
            --github-output "$GITHUB_OUTPUT"

      - name: Check GitHub links
        run: |
          python3 scripts/check_github_links.py --site-dir _site

      # Snapshot the sitemap that is live *before* this deploy so the IndexNow
      # step can submit only URLs this deploy added or changed.
      - name: Snapshot live sitemap
        if: >-
          github.ref == 'refs/heads/master' &&
          steps.deploy-check.outputs.is-current == 'true'
        continue-on-error: true
        run: |
          curl -fsS --max-time 30 https://timetobuildbob.com/sitemap.xml -o "$RUNNER_TEMP/prev-sitemap.xml" \
            || rm -f "$RUNNER_TEMP/prev-sitemap.xml"

      - name: Deploy 🚀
        uses: JamesIves/github-pages-deploy-action@v4
        if: >-
          github.ref == 'refs/heads/master' &&
          steps.deploy-check.outputs.is-current == 'true'
        with:
          branch: gh-pages
          folder: _site
          git-config-name: GitHub Actions
          git-config-email: noreply@github.com

      # Ping IndexNow (Bing, Yandex, Seznam, Naver, ...) with URLs this deploy
      # published. Google doesn't participate — it uses the sitemap + Search
      # Console. Waits for Pages to serve each URL; never fails the deploy.
      - name: Submit new URLs to IndexNow
        if: >-
          github.ref == 'refs/heads/master' &&
          steps.deploy-check.outputs.is-current == 'true'
        continue-on-error: true
        timeout-minutes: 8
        run: |
          python3 scripts/indexnow_submit.py --previous "$RUNNER_TEMP/prev-sitemap.xml" --site-dir _site

      # The push above only hands gh-pages to GitHub's Pages builder, which
      # publishes asynchronously and can fail while this job stays green
      # (2026-11-07: stale ~15h). Fail the run if the live feed never shows the
      # newest built post; the script requests one Pages rebuild first.
      - name: Verify live site serves the newest post
        if: >-
          github.ref == 'refs/heads/master' &&
          steps.deploy-check.outputs.is-current == 'true'
        run: |
          python3 scripts/check_live_deploy.py \
            --site-dir _site \
            --repository "${{ github.repository }}" \
            --token "${{ github.token }}"