-
Notifications
You must be signed in to change notification settings - Fork 0
Repair release integrity and complete Article Two evidence #7
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
b17e603
Repair release integrity and complete Article Two evidence
erinepshovel-code 32ef45d
Replace dynamic canon note regex construction
erinepshovel-code f80cb09
Remove test-server filesystem race and harden paths
erinepshovel-code 2e55189
Use file descriptors in the browser test server
erinepshovel-code File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| # GitHub Pages release truth | ||
|
|
||
| The production artifact is `_site`. A release is not complete merely because source exists on `main` or a Pages job reports that an artifact was uploaded. | ||
|
|
||
| ## Repository contract | ||
|
|
||
| 1. `npm run check` refreshes canon and organization data, verifies provenance, validates all routes, compares every rights-article excerpt and note with the selected canon, generates the Eleventy site and Pagefind index, and runs generated-site tests. | ||
| 2. Browser and accessibility checks run against the generated artifact before upload. | ||
| 3. `_site/build.json` records the exact site commit and canonical source identity. | ||
| 4. After deployment, both the GitHub Pages URL and `https://interdependentway.org/build.json` must report the expected commit. A stale or missing identity fails the workflow. | ||
|
|
||
| ## Required GitHub configuration | ||
|
|
||
| These settings are outside repository source control and require repository administration: | ||
|
|
||
| - **Settings → Pages → Build and deployment → Source:** GitHub Actions. | ||
| - **Custom domain:** `interdependentway.org`. | ||
| - **DNS:** the apex and any intended `www` record must resolve according to GitHub Pages guidance and pass GitHub's domain check. | ||
| - **Enforce HTTPS:** enabled after the certificate is available. | ||
| - **Environment:** `github-pages` must allow the Pages workflow to deploy. | ||
| - **Branch protection:** require the `Verify generated site` pull-request check before merging to `main`. | ||
|
|
||
| ## Incident reading | ||
|
|
||
| - Branch-root `index.html` is a recovery floor, not the preferred publication. | ||
| - The generated site is current only when `/build.json` matches the expected deployment SHA. | ||
| - Canon freshness is separately shown by the canonical repository, commit, blob, content digest, and fallback flag in the same file. | ||
|
|
||
| ## hmmm | ||
|
|
||
| The workflow can prove what was built and what the public endpoints serve. It cannot change DNS, attach the custom domain, enable HTTPS, or alter Pages source settings from repository code; those remain explicit administrative boundaries. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| // Usage: run `npm run test:browser` after `npm run build`; CI installs Chromium before execution. | ||
| // Limits: tests the generated artifact on loopback and does not replace live deployment identity verification. | ||
| // === MODULE_BUILD === | ||
| // id: generated_site_browser_harness | ||
| // module_name: playwright-config | ||
| // module_kind: instrument | ||
| // summary: Configures browser, route, and automated accessibility checks against the generated site. | ||
| // owner: Erin Spencer | ||
| // public_surface: npm run test:browser, npm run test:e2e, npm run test:a11y | ||
| // internal_surface: Playwright webServer and Chromium test configuration | ||
| // auth_boundary: none | ||
| // storage_boundary: read | ||
| // network_boundary: internal | ||
| // user_data_boundary: none | ||
| // admin_only: false | ||
| // tests: tests/site.spec.mjs, tests/accessibility.spec.mjs | ||
| // rollout: required by pull-request and Pages workflows | ||
| // rollback: remove browser scripts, workflow steps, and static test server together | ||
| // === END MODULE_BUILD === | ||
| // === BOUNDARIES === | ||
| // id: generated_site_browser_harness_boundary | ||
| // summary: Launches Chromium and a loopback-only static server against generated public files. | ||
| // auth_boundary: none | ||
| // storage_boundary: read | ||
| // network_boundary: internal | ||
| // user_data_boundary: none | ||
| // admin_only: false | ||
| // pii: none | ||
| // secrets: none | ||
| // side_effects: browser processes, loopback listener | ||
| // owner: Erin Spencer | ||
| // === END BOUNDARIES === | ||
| import { defineConfig } from '@playwright/test'; | ||
|
|
||
| export default defineConfig({ | ||
| testDir: './tests', | ||
| testMatch: ['**/*.spec.mjs'], | ||
| fullyParallel: false, | ||
| retries: process.env.CI ? 1 : 0, | ||
| reporter: process.env.CI ? 'github' : 'list', | ||
| use: { | ||
| baseURL: 'http://127.0.0.1:4173', | ||
| browserName: 'chromium', | ||
| trace: 'retain-on-failure' | ||
| }, | ||
| webServer: { | ||
| command: 'node scripts/serve-static.mjs', | ||
| port: 4173, | ||
| reuseExistingServer: !process.env.CI, | ||
| timeout: 30000 | ||
| } | ||
| }); |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In the deploy job, this is the first step that references repository files, but that job never runs
actions/checkout(the checkout only happens in the separate build job). Because GitHub Actions jobs run on fresh runners, there will be noscripts/verify-live-deployment.mjson disk afteractions/deploy-pages, so every otherwise-successful Pages deployment will fail here with a module-not-found error before the identity check can run.Useful? React with 👍 / 👎.