Publish static site bundles to Garage

.forgejo/workflows/deploy.yml

@@ -1,118 +1,78 @@
+name: Publish static bundles
+
 on:
   push:
     branches: [main]
   workflow_dispatch:
 
 concurrency:
-  group: deploy-main
+  group: publish-main
   cancel-in-progress: true
 
 jobs:
-  deploy:
+  publish:
     runs-on: docker
     container:
       image: node:24-bookworm
     timeout-minutes: 30
+    env:
+      AWS_ACCESS_KEY_ID: ${{ secrets.GARAGE_SITES_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.GARAGE_SITES_SECRET_ACCESS_KEY }}
+      AWS_DEFAULT_REGION: garage-sites
+      GARAGE_S3_ENDPOINT: https://s3-sites.bcgen.ie
+      NODE_OPTIONS: --max-old-space-size=768
+      PUBLIC_ANALYTICS_DASHBOARD_URL: ${{ secrets.PUBLIC_ANALYTICS_DASHBOARD_URL }}
+      PUBLIC_CONTACT_FORM_ENDPOINT: ${{ secrets.PUBLIC_CONTACT_FORM_ENDPOINT }}
+      PUBLIC_CONTACT_RECIPIENTS: ${{ secrets.PUBLIC_CONTACT_RECIPIENTS }}
+      PUBLIC_CONTACT_SUBMISSIONS_URL: ${{ secrets.PUBLIC_CONTACT_SUBMISSIONS_URL }}
+      PUBLIC_PLAUSIBLE_DOMAIN: ${{ secrets.PUBLIC_PLAUSIBLE_DOMAIN }}
+      PUBLIC_PLAUSIBLE_SCRIPT_SRC: ${{ secrets.PUBLIC_PLAUSIBLE_SCRIPT_SRC }}
     steps:
-      - name: Install deploy tools
+      - uses: actions/checkout@v4
+
+      - name: Install build and S3 tools
         run: |
           set -eu
           apt-get update -qq
-          apt-get install -y -q ca-certificates curl git jq
+          apt-get install -y -q ca-certificates python3-venv
+          python3 -m venv /opt/awscli
+          /opt/awscli/bin/pip install --quiet awscli
 
-      - name: Build Astro and restart Nomad
+      - name: Build and validate Astro output
-        env:
-          NOMAD_ADDR: ${{ secrets.NOMAD_ADDR }}
-          NOMAD_TOKEN: ${{ secrets.NOMAD_TOKEN }}
-          PUBLIC_ANALYTICS_DASHBOARD_URL: ${{ secrets.PUBLIC_ANALYTICS_DASHBOARD_URL }}
-          PUBLIC_CONTACT_FORM_ENDPOINT: ${{ secrets.PUBLIC_CONTACT_FORM_ENDPOINT }}
-          PUBLIC_CONTACT_RECIPIENTS: ${{ secrets.PUBLIC_CONTACT_RECIPIENTS }}
-          PUBLIC_CONTACT_SUBMISSIONS_URL: ${{ secrets.PUBLIC_CONTACT_SUBMISSIONS_URL }}
-          PUBLIC_PLAUSIBLE_DOMAIN: ${{ secrets.PUBLIC_PLAUSIBLE_DOMAIN }}
-          PUBLIC_PLAUSIBLE_SCRIPT_SRC: ${{ secrets.PUBLIC_PLAUSIBLE_SCRIPT_SRC }}
-          NODE_OPTIONS: --max-old-space-size=768
-          REPO_URL: https://git.bcgen.ie/familyfedie/familyfedie-website.git
         run: |
           set -eu
-          export REF_NAME="${GITHUB_REF_NAME:-main}"
+          npm ci --no-audit --no-fund
+          npm run check
 
-          git config --global http.lowSpeedLimit 1024
+      - name: Split public and protected admin bundles
-          git config --global http.lowSpeedTime 60
+        run: |
+          set -eu
+          rm -rf bundle-public bundle-admin
+          mkdir -p bundle-public bundle-admin/admin bundle-admin/css
+          cp -a dist/. bundle-public/
+          rm -rf bundle-public/admin bundle-public/admin.html
+          test ! -e bundle-public/admin
+          test ! -e bundle-public/admin.html
 
-          for attempt in 1 2 3; do
+          cp dist/admin/index.html bundle-admin/index.html
-            echo "Cloning $REPO_URL ($REF_NAME), attempt $attempt/3"
+          cp dist/admin/index.html bundle-admin/admin/index.html
-            rm -rf source
+          cp -a dist/admin/content bundle-admin/admin/content
-            if timeout 180 git clone --depth 1 --branch "$REF_NAME" "$REPO_URL" source; then
+          cp dist/css/admin.css bundle-admin/css/admin.css
-              break
-            fi
-            if [ "$attempt" -eq 3 ]; then
-              echo "git clone failed after 3 attempts" >&2
-              exit 1
-            fi
-            sleep $((attempt * 10))
-          done
 
-          cd source
+      - name: Publish to Garage
-          npm config set fetch-retries 4
+        run: |
-          npm config set fetch-retry-mintimeout 10000
+          set -eu
-          npm config set fetch-retry-maxtimeout 60000
+          aws=/opt/awscli/bin/aws
-          npm config set fetch-timeout 300000
+          common="--endpoint-url $GARAGE_S3_ENDPOINT --no-progress"
 
-          echo "Installing npm dependencies..."
+          $aws $common s3 sync bundle-public s3://familyfed.ie --delete \
-          timeout 600 npm ci --no-audit --no-fund
+            --cache-control 'public, max-age=3600, must-revalidate'
-          rm -rf dist
+          $aws $common s3 cp bundle-public s3://familyfed.ie --recursive \
-          echo "Building Astro site..."
+            --exclude '*' --include '*.html' \
-          timeout 600 npm run build
+            --cache-control 'public, max-age=0, must-revalidate'
+          $aws $common s3 cp bundle-public s3://familyfed.ie --recursive \
+            --exclude '*' --include '*.json' \
+            --cache-control 'public, max-age=0, must-revalidate'
 
-          test -f dist/index.html
+          $aws $common s3 sync bundle-admin s3://admin.familyfed.ie --delete \
-          test -f dist/admin/index.html
+            --cache-control 'private, max-age=0, must-revalidate'
-          test -f dist/speeches/index.html
-          test -f dist/assets/icons/familyfed-favicon.png
-
-          export DEPLOY_MANIFEST="$(
-            cd dist
-            find . -type f -print0 \
-              | LC_ALL=C sort -z \
-              | xargs -0 sha256sum \
-              | sha256sum \
-              | awk '{print $1}'
-          )"
-
-          export DEPLOY_COMMIT="${GITHUB_SHA:-$(git rev-parse HEAD)}"
-          echo "Registering Nomad deployment for $DEPLOY_COMMIT ($DEPLOY_MANIFEST)"
-          curl -fsS \
-            --connect-timeout 15 \
-            --max-time 60 \
-            --retry 3 \
-            --retry-delay 5 \
-            --retry-all-errors \
-            -H "X-Nomad-Token: $NOMAD_TOKEN" \
-            "$NOMAD_ADDR/v1/job/familyfed" \
-            | jq '
-                (.TaskGroups[].Tasks[].Env //= {})
-                | .TaskGroups[].Tasks[].Env.DEPLOY_COMMIT = env.DEPLOY_COMMIT
-                | ((.TaskGroups[].Tasks[] | select(.Name == "build-site") | .Config.args[]) |=
-                    (sub("/archive/[0-9a-f]{40}\\.tar\\.gz";
-                         "/archive/" + env.DEPLOY_COMMIT + ".tar.gz")
-                     | sub("test \"\\$actual_manifest\" = \"[0-9a-f]{64}\""; ":")))
-                | (.TaskGroups[].Tasks[].Artifacts[]?.GetterSource |=
-                    if startswith("git::") and test("[?&]ref=") then
-                      sub("ref=[^&]*"; "ref=" + env.DEPLOY_COMMIT)
-                    elif startswith("git::") then
-                      . + (if contains("?") then "&" else "?" end) + "ref=" + env.DEPLOY_COMMIT
-                    else . end)
-                | {Job: .}
-              ' \
-            > /tmp/familyfed-job.json
-
-          curl -fsS -X POST \
-            --connect-timeout 15 \
-            --max-time 60 \
-            --retry 3 \
-            --retry-delay 5 \
-            --retry-all-errors \
-            -H "Content-Type: application/json" \
-            -H "X-Nomad-Token: $NOMAD_TOKEN" \
-            --data-binary @/tmp/familyfed-job.json \
-            "$NOMAD_ADDR/v1/jobs"
-          echo "Deploy registered. Nomad will replace the allocation and re-fetch the site."

src/pages/admin/index.astro

@@ -55,7 +55,7 @@ const adminConfig = {
 
     <div class="admin-app">
       <aside class="admin-sidebar" aria-label="Admin navigation">
-        <a class="admin-brand" href="/" aria-label="FamilyFed.ie home">
+        <a class="admin-brand" href="https://familyfed.ie/" aria-label="FamilyFed.ie home">
           <span class="admin-brand-mark">
             <img src={familyFedIconUrl} alt="" />
           </span>
@@ -144,7 +144,7 @@ const adminConfig = {
             <span class={`admin-status-pill ${configuredServices === 2 ? "is-ready" : "is-warning"}`}>
               {configuredServices === 2 ? "Services ready" : `${configuredServices}/2 services ready`}
             </span>
-            <a class="admin-link-button" href="/" target="_blank" rel="noreferrer">
+            <a class="admin-link-button" href="https://familyfed.ie/" target="_blank" rel="noreferrer">
               <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true">
                 <path d="M14 5h5v5M19 5l-8 8"></path>
                 <path d="M19 13v6H5V5h6"></path>
@@ -180,7 +180,7 @@ const adminConfig = {
                   </svg>
                   Add speech
                 </button>
-                <a class="admin-link-button" href="/" target="_blank" rel="noreferrer">Open public site</a>
+                <a class="admin-link-button" href="https://familyfed.ie/" target="_blank" rel="noreferrer">Open public site</a>
               </div>
             </section>
 
@@ -309,7 +309,7 @@ const adminConfig = {
                 <p>Fill in the event details. The repository-ready snippet updates automatically as you type.</p>
               </div>
               <div class="admin-section-actions">
-                <a class="admin-link-button" href="/events" target="_blank" rel="noreferrer">View public calendar</a>
+                <a class="admin-link-button" href="https://familyfed.ie/events" target="_blank" rel="noreferrer">View public calendar</a>
               </div>
             </header>
 
@@ -417,7 +417,7 @@ const adminConfig = {
                 <p>Search the archive, open an existing speech, or generate a new Markdown file.</p>
               </div>
               <div class="admin-section-actions">
-                <a class="admin-link-button" href="/speeches" target="_blank" rel="noreferrer">View speech archive</a>
+                <a class="admin-link-button" href="https://familyfed.ie/speeches" target="_blank" rel="noreferrer">View speech archive</a>
                 <button class="admin-button admin-button-primary" type="button" data-add-speech>
                   <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" aria-hidden="true">
                     <path d="M12 5v14M5 12h14"></path>