deploy.yml

name: Build and deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  pages: write
  id-token: write

# Let a running deploy finish rather than cancelling it half-published.
concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: "3.3"
          bundler-cache: true

      - name: Configure Pages
        id: pages
        uses: actions/configure-pages@v5

      - name: Build
        env:
          # Without this the Google Analytics tag is omitted -- the snippet is
          # gated on jekyll.environment == "production", which defaults to
          # "development". It would fail silently and look completely fine.
          JEKYLL_ENV: production
        # Both the origin and the base path come from the Pages config rather
        # than being hardcoded. On a project site that is
        # https://<user>.github.io + /<repo>; once a custom domain is attached
        # it becomes the real origin with an empty base path. Overriding `url`
        # matters because the 136 redirect stubs and every canonical tag are
        # built from it -- left at the production domain, a staging deploy would
        # bounce visitors straight to the old live site.
        run: |
          # Force https. configure-pages reports the origin as http:// until
          # "Enforce HTTPS" is ticked, and that can only happen after the
          # certificate issues -- so a deploy made in that window would bake
          # http:// into every canonical tag and all 136 redirect stubs.
          origin="${{ steps.pages.outputs.origin }}"
          printf 'url: "%s"\n' "${origin/#http:\/\//https://}" > _config.pages.yml
          cat _config.pages.yml
          bundle exec jekyll build \
            --config _config.yml,_config.pages.yml \
            --baseurl "${{ steps.pages.outputs.base_path }}" \
            --trace

      # Posts are authored with plain root-absolute paths -- ![](/assets/img/…) --
      # which is correct at the custom domain and keeps Liquid out of the
      # Markdown. A project-site deploy serves everything under /<repo>, so the
      # prefix is injected here instead of taxing every future post.
      #
      # Only content carries unprefixed paths; layouts and includes already run
      # theirs through relative_url. Matching the unprefixed form specifically
      # is therefore safe and cannot double-prefix.
      - name: Prefix content paths for a project-site deploy
        if: steps.pages.outputs.base_path != ''
        env:
          BASE_PATH: ${{ steps.pages.outputs.base_path }}
        run: |
          set -euo pipefail

          # grep exits 1 when it finds nothing, which under pipefail would fail
          # this step precisely when the rewrite had worked. Swallow that.
          count() { { grep -rho 'src="/assets/' _site --include=*.html || true; } | wc -l; }

          before=$(count)
          find _site -name '*.html' -print0 | xargs -0 sed -i \
            -e "s|=\"/assets/|=\"${BASE_PATH}/assets/|g" \
            -e "s|=\"/posts/|=\"${BASE_PATH}/posts/|g"
          after=$(count)
          echo "prefixed $before content asset refs with ${BASE_PATH} ($after left unprefixed)"
          test "$after" -eq 0

      - name: Sanity-check the build
        run: |
          set -euo pipefail

          # A stylesheet needs front matter for Jekyll to process it, which also
          # makes it a Page -- and a layout default can then wrap it in HTML.
          # That shipped once: HTTP 200, plausible size, not one rule applied.
          for f in _site/assets/css/main.css _site/assets/js/site.js _site/search.json; do
            test -s "$f" || { echo "::error::missing or empty: $f"; exit 1; }
            if head -c 40 "$f" | grep -qiE '<!doctype html|<html'; then
              echo "::error::$f was rendered as an HTML document"; exit 1
            fi
          done

          test -f _site/404.html || { echo "::error::no 404.html"; exit 1; }
          test -f _site/feed.xml || { echo "::error::no feed.xml"; exit 1; }
          test -f _site/sitemap.xml || { echo "::error::no sitemap.xml"; exit 1; }

          posts=$(find _site/posts -name index.html | wc -l)
          test "$posts" -ge 136 || { echo "::error::only $posts posts built"; exit 1; }

          # Every post keeps its original Blogger URL; losing these silently
          # would break 14 years of inbound links.
          redirects=$(find _site -regex '.*_site/20[0-9][0-9]/.*\.html' | wc -l)
          test "$redirects" -ge 136 || { echo "::error::only $redirects redirects built"; exit 1; }

          if grep -rq "blogger.googleusercontent.com" _site --include=*.html; then
            echo "::error::a page still points at googleusercontent"; exit 1
          fi

          echo "$posts posts, $redirects redirects, all assets served as themselves"

      - uses: actions/upload-pages-artifact@v3

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - id: deployment
        uses: actions/deploy-pages@v4