portfolio-react/.github/workflows/ci-cd.yml at main · Sagargupta16/portfolio-react · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
name: Portfolio CI/CD

on:
   push:
      branches: [main]
   pull_request:
      branches: [main]
   # Rebuild after the Credly sync bot pushes new badge data. A push by the
   # default GITHUB_TOKEN does not retrigger `on: push`, so deploy via
   # workflow_run instead (not subject to that restriction).
   workflow_run:
      workflows: ["Sync Credly Badges"]
      types: [completed]

# Allow only one concurrent deployment
concurrency:
   group: "pages-${{ github.ref }}"
   cancel-in-progress: true

jobs:
   ci:
      runs-on: ubuntu-latest
      permissions:
         contents: read
         pages: write
         id-token: write
      timeout-minutes: 20
      steps:
         - name: Checkout code
           uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

         - name: Setup pnpm
           uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
           with:
              version: 11

         - name: Setup Node.js
           uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
           with:
              node-version: 24
              cache: "pnpm"

         - name: Install dependencies
           run: pnpm install --frozen-lockfile

         - name: Lint code
           run: pnpm lint

         - name: Validate JSON data files
           run: |
              echo "Validating JSON data files..."
              find data -name "*.json" -exec echo "Checking {}" \; -exec node -e "JSON.parse(require('fs').readFileSync('{}', 'utf8'))" \;

         # Self-host the resume for the in-site CV viewer: fetch the latest
         # release PDF and pre-render each page to high-res WebP (crisp images,
         # no client-side PDF machinery). Runs before the build so Vite copies
         # public/resume* into build/.
         - name: Prepare resume (fetch PDF + render page images)
           run: pnpm fetch:resume

         - name: Build with Vite
           run: pnpm build

         - name: Security audit
           run: |
              echo "Running security audit..."
              pnpm audit --audit-level=high || echo "Security vulnerabilities found, but continuing build"
           continue-on-error: true

         - name: Setup Pages
           uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6

         - name: Upload artifact
           uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
           with:
              path: "build"

   deploy:
      if: >
         (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
         (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
      permissions:
         pages: write
         id-token: write
      environment:
         name: github-pages
         url: ${{ steps.deployment.outputs.page_url }}
      runs-on: ubuntu-latest
      needs: ci
      steps:
         - name: Deploy to GitHub Pages
           id: deployment
           uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5