cd.yml

name: CD
on:
  release:
    types: [published]
permissions:
  contents: read
jobs:
  pages:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false # no step pushes back to the repository
      - name: Install mise toolchain
        uses: jdx/mise-action@v4
        with:
          cache: false # a poisoned tool cache must never reach published artifacts
      - name: Build API documentation
        run: mise run docs
      - name: Configure Pages
        uses: actions/configure-pages@v6
      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@v5
        with:
          path: docs/
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v5
  image:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false # the registry login below carries its own token
      - name: Set lower-case image path
        # GitHub expands `${{ }}` before the shell runs, so repository references reach
        # the script through `env:` rather than being interpolated into the command.
        env:
          REPOSITORY: ${{ github.repository }}
        run: echo "IMAGE=$(echo "ghcr.io/$REPOSITORY" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Build and push image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          tags: |
            ${{ env.IMAGE }}:latest
            ${{ env.IMAGE }}:${{ github.ref_name }}