deploy.yml

name: Deploy

# The site is built here rather than by Vercel's git integration, and only the
# finished static files are handed to Vercel (`vercel deploy --prebuilt`). The
# build job never sees the Vercel credentials, and the deploy job never runs the
# build.

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      production:
        description: Publish on pnpm.io. Turn this off to get a preview URL instead.
        type: boolean
        default: true

# A deploy always ships the whole site, so an in-flight one is pointless as
# soon as a newer commit lands.
concurrency:
  group: deploy
  cancel-in-progress: true

# Nothing here writes to the repository; the deploy goes out through Vercel.
permissions:
  contents: read

env:
  COREPACK_ENABLE_AUTO_PIN: 0

jobs:
  build:
    runs-on: ubuntu-latest
    environment: deploy
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/setup@v2
      - id: window
        run: echo "hour=$(date -u +%Y-%m-%dT%H)" >> "$GITHUB_OUTPUT"
      - name: Reuse a recent download
        # Every push to the default branch deploys, and asking Crowdin to
        # export the project that often is what its rate limit is there to
        # stop. One export an hour is plenty: the translations move at the
        # pace of the translators, not of the commits.
        id: reuse
        uses: actions/cache/restore@v4
        with:
          path: i18n
          key: translations-${{ steps.window.outputs.hour }}
          restore-keys: translations-
      - name: Download the translations
        # Reuses a download younger than an hour, retries when Crowdin refuses
        # the export (it answers 429 rather than waiting), falls back to the
        # last download when it keeps refusing, and fails when a locale of
        # locales.json has no translations: that locale would reach the site
        # as an untranslated page.
        id: translations
        run: pnpm download-translations
        env:
          CROWDIN_PROJECT_ID: ${{ vars.CROWDIN_PROJECT_ID || '302994' }}
          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
      - name: Keep the download for the next deploys
        if: steps.translations.outputs.source == 'downloaded'
        uses: actions/cache/save@v4
        with:
          path: i18n
          key: translations-${{ steps.window.outputs.hour }}
      - name: Build
        # Every locale, version and page at once, into build/.
        run: pnpm build
        env:
          # The build reads the translation progress of every language from
          # Crowdin, for the language menu. It would also try to export the
          # translations again when the download above is more than an hour
          # old, which only happens when Crowdin just refused to export, so
          # it doesn't get the token then.
          CROWDIN_PERSONAL_TOKEN: ${{ steps.translations.outputs.source != 'stale' && secrets.CROWDIN_PERSONAL_TOKEN || '' }}
          # The /benchmarks page reads pnpm/benchmarks through the GitHub API
          # at build time. Unauthenticated, the API allows 60 requests an hour
          # per address, which shared runners can exhaust, and then the page
          # falls back to a bundled snapshot.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Check that every URL of the site is still served
        run: pnpm check-urls
      - uses: actions/upload-artifact@v4
        with:
          name: site
          path: build
          retention-days: 1
          # The files are already minified; compressing them again costs more
          # time than it saves on the transfer.
          compression-level: 0

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment: deploy
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/setup@v2
      - name: Collect the site
        uses: actions/download-artifact@v4
        with:
          name: site
          path: .site-artifacts
      - name: Deploy to Vercel
        # `vercel build` doesn't rebuild the site: vercel.json points its build
        # command at scripts/assemble-site.mjs, which just moves the artifact
        # into place. It is still needed to turn vercel.json into a deployment.
        run: |
          # esbuild, which the CLI depends on, has to run its install script.
          vercel () { pnx --allow-build=esbuild vercel@59.1.4 "$@"; }
          if [ "$PRODUCTION" = 'true' ]; then
            environment=production
            prod=--prod
          else
            environment=preview
            prod=
          fi
          vercel pull --yes --environment="$environment" --token="$VERCEL_TOKEN"
          vercel build $prod --token="$VERCEL_TOKEN"
          # The site has more files than Vercel's 15,000-file API limit, so
          # upload it as one archive instead of individual files.
          url=$(vercel deploy --prebuilt --archive=tgz $prod --token="$VERCEL_TOKEN" | tail -n1)
          echo "Deployed $url" >> "$GITHUB_STEP_SUMMARY"
        env:
          PRODUCTION: ${{ github.event_name != 'workflow_dispatch' || inputs.production }}
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
          VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}