1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
name: Build and deploy to Pages

on:
  # Build every branch so a change is checked before it reaches the default
  # branch; the deploy job below is what is gated.
  push:
  pull_request:
  workflow_dispatch:

# The site is its own small Ruby/ERB build (see lib/build.rb and Rakefile)
# rather than Jekyll, so it has to build on Actions rather than GitHub's
# hosted Jekyll build regardless — this also pins the build to Ruby 4.0
# rather than whatever Ruby GitHub Pages uses.

# Default-deny; each job grants only what it needs below.
permissions: {}

# Cancel a superseded run within a PR; queue runs on the default branch so a
# deploy is never cancelled midway.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    permissions:
      contents: read # checkout.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false

      - name: Set up Ruby 4.0
        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
        with:
          # Resolves to the latest 4.0.x the runner has, so a patch release
          # does not need a commit here.
          ruby-version: "4.0"
          bundler-cache: true

      - name: Report the toolchain
        run: ruby -v

      # BASEURL is a constant in lib/build.rb rather than coming from
      # actions/configure-pages, so the build does not depend on the Pages API
      # being reachable and stays green on branches and forks. Change it
      # there if the site ever moves off a project page.
      - name: Build
        run: bundle exec rake build

      - name: Check the build output
        run: |
          test -s _site/index.html
          test -s _site/assets/css/tokens.css
          grep -q -- '--gl-color-accent:' _site/assets/css/tokens.css
          # Every page in the nav should have been rendered.
          for page in rationale install foundations/color foundations/typography \
                      foundations/space foundations/elevation foundations/motion \
                      components/button components/icon-button components/badge \
                      components/tag components/card components/card-row \
                      components/field components/input components/select \
                      components/checkbox components/radio components/switch \
                      components/tooltip components/toast components/dialog \
                      components/tabs \
                      patterns/loop patterns/archive; do
            test -s "_site/$page/index.html" || { echo "missing $page"; exit 1; }
          done

      - name: Upload artifact
        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1

  # Requires Pages to be set to "GitHub Actions" once, under
  # Settings -> Pages -> Build and deployment. The workflow token is not
  # permitted to turn that on for you.
  deploy:
    needs: build
    # Deploy from whichever branch the repository calls default, rather than a
    # hard-coded name.
    if: github.ref_name == github.event.repository.default_branch && github.event_name != 'pull_request'
    permissions:
      pages: write    # deploy to Pages.
      id-token: write # OIDC token to authenticate the Pages deployment.
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

  zizmor:
    permissions:
      contents: read         # checkout.
      security-events: write # upload SARIF to code scanning.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
        with:
          # The action refuses both at once: SARIF goes to the security tab,
          # or findings are annotated inline on the diff, not both. This repo
          # wants the security tab, so annotations stays off (its default).
          advanced-security: true # emit SARIF for the security tab.