Julien Gautier
204727b1a7
CI / commits (pull_request) Successful in 3m57s
CI / scan (pull_request) Successful in 4m20s
CI / check (pull_request) Successful in 6m13s
CI / a11y (pull_request) Successful in 2m53s
Docs site / build (pull_request) Successful in 4m0s
CI / perf (pull_request) Successful in 7m41s
The NODE_OPTIONS=--use-system-ca workaround merged in #199 did not clear the failure — the same TLS-chain rejection still trips the runner. Either the runner's OS CA store also lacks the missing intermediate, or `--use-system-ca` does not propagate down to the node-fetch@2 used by node-pre-gyp. Without runner shell access the exact reason is not worth investigating. Different angle: grpc-tools is never invoked in CI. The protoc binary it downloads is only used by `pnpm run grpc:codegen`, which runs on a developer's machine when a proto file changes. The generated TypeScript stubs in apps/portal-bff/src/grpc/gen/ are committed (per ADR-0024 §"Sub-decision 3 — vendored protos"), so CI only needs to type-check them — protoc is dead weight there. Move grpc-tools from devDependencies to optionalDependencies. Per pnpm semantics, an optional dependency whose install (including postinstall) fails is logged as a warning and the overall install continues. On the runner: postinstall still fails on TLS, pnpm emits a warning, ci:check proceeds. On a developer machine: TLS validates, postinstall runs, protoc binary lands, `pnpm grpc:codegen` works exactly as before. No dev-side friction; no workflow env vars to maintain. Reverts the workflow `env:` blocks added in #199 — they did not help and adding noise to the workflow YAML for a non-working workaround is worse than removing it.
74 lines
2.7 KiB
YAML
74 lines
2.7 KiB
YAML
# Per ADR-0022 (Documentation site — VitePress).
|
|
# Builds the static docs site from `docs/`. On `pull_request` the
|
|
# build is a syntax / dead-link gate; on `push` to `main` the same
|
|
# build runs and the bundle is uploaded as an artifact so the
|
|
# operator can drop it on the static host until the future
|
|
# infrastructure ADR locks the rsync target.
|
|
#
|
|
# Path filter scopes the workflow to changes that can actually
|
|
# affect the rendered site: documentation content, the VitePress
|
|
# configuration itself, and dependency manifests (Vite/VitePress
|
|
# upgrades).
|
|
|
|
name: Docs site
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- 'docs/**'
|
|
- 'package.json'
|
|
- 'pnpm-lock.yaml'
|
|
- '.gitea/workflows/docs-site.yml'
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'docs/**'
|
|
- 'package.json'
|
|
- 'pnpm-lock.yaml'
|
|
- '.gitea/workflows/docs-site.yml'
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: [self-hosted, on-prem]
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- uses: pnpm/action-setup@v6
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: '.nvmrc'
|
|
cache: 'pnpm'
|
|
- run: pnpm install --frozen-lockfile
|
|
# `pnpm docs:build` runs `vitepress build docs` per the script
|
|
# added in this chantier. Fails the workflow on:
|
|
# - markdown / Vue-template parse errors,
|
|
# - genuine dead in-site links (the config's
|
|
# `ignoreDeadLinks` regex already covers the intentional
|
|
# cross-repo + localhost references that must not break
|
|
# the build).
|
|
- name: Build docs site
|
|
run: pnpm docs:build
|
|
# Sanity-check: the build must produce HTML where the Mermaid
|
|
# plugin has injected its diagram markers. Guards against a
|
|
# silent regression on the plugin upgrade path — `pnpm install`
|
|
# might happily resolve a new major that no longer hooks into
|
|
# markdown-it the same way, leaving fenced ```mermaid blocks
|
|
# as raw text. Per ADR-0022 §"Confirmation".
|
|
- name: Assert Mermaid renders into the build output
|
|
run: |
|
|
if ! grep -RIlq 'class="mermaid"\|<svg' docs/.vitepress/dist/decisions/0009-auth-flow-oidc-pkce-msal-node.html; then
|
|
echo "ADR-0009's Mermaid sequence diagram did not render — Mermaid plugin regression?" >&2
|
|
exit 1
|
|
fi
|
|
# On push only — upload the static bundle so the operator can
|
|
# rsync it to the host until the future infra ADR formalises
|
|
# the deployment target. The artifact lives 30 days in Gitea's
|
|
# storage by default.
|
|
- name: Upload docs bundle
|
|
if: github.event_name == 'push'
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: docs-site
|
|
path: docs/.vitepress/dist/
|
|
retention-days: 30
|