docs-deploy.yaml

name: Deploy docs

# Builds and deploys the Starlight docs site to GitHub Pages on every push to
# main that touches the docs source or this workflow. PR-time build validation
# lives in the PR Validation workflow's gate, so a broken docs build blocks the
# merge there; this workflow only builds and deploys on push to main.
on:
  push:
    branches: [main]
    paths:
      - 'docs/**'
      - '.github/workflows/docs-deploy.yaml'

# Least-privilege: read the repo, mint an OIDC token for Pages, write the Pages
# deployment. No other scopes.
permissions:
  contents: read
  pages: write
  id-token: write

# Serialize Pages deployments. Do NOT cancel in progress: a half-applied Pages
# deploy can leave the live site inconsistent, so let each one finish.
concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: docs
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: docs/package-lock.json
      - name: Install dependencies
        run: npm ci
      - name: Build site
        run: npm run build
      - name: Upload Pages artifact
        if: github.event_name == 'push'
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: docs/dist

  deploy:
    needs: build
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0