name: Build website & deploy to GitHub Pages

on:
  # Runs on pushes targeting the default branch
  push:
    branches: ["master"]

  # On pull requests which touch the website we build it but don't deploy to
  # Pages, so that broken changes are caught in review rather than after
  # merging; the website-preview workflow then deploys the uploaded artifact
  # to Cloudflare Pages as a live preview.
  pull_request:
    branches: ["master"]
    paths:
      - "website/**"
      - "brand/**"
      - ".github/workflows/website*.yml"

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

permissions:
  contents: read

# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
# Pull request builds don't deploy, so they get a per-branch group and are cancelled by later pushes.
concurrency:
  group: ${{ github.event_name == 'pull_request' && format('website-{0}', github.head_ref) || 'pages' }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          lfs: true
          persist-credentials: false
      - name: Build website
        run: ./build.sh website
      # Serve this with e.g. `python -m http.server` instead of opening the
      # files directly, because the site uses root-relative links.
      - name: Upload preview artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: website
          path: 'website/output/'
          retention-days: 14
      - name: Upload Pages artifact
        if: github.event_name != 'pull_request'
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: 'website/output/'

  deploy:
    needs: build
    if: github.event_name != 'pull_request'
    # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
