# Workflows

knotless.dev's runners run these for chadtmiller.com/pds.js: `ci` on the
hosted runner, runner.knotless.dev, and every workflow given a secret on
ci.knotless.dev, the runner on knotless.dev's own host, each naming its
runner in `runners`. The
format is in knotless's
[workflow reference](https://knotless.dev/chadtmiller.com/knotless/blob/main/docs/reference/workflows.md).
The runner reads only the `.yml`, `.yaml` and `.json` files here. Each
workflow says what it does, and why, in its comments.

- `ci` is the gate, on every branch and on pulls into main.
- `mirror-repo` pushes main and each `v*` tag to `atproto://pdsjs.dev/pds.js`.
- `canary-worker`, `publish-git-app`, `publish-spaces-app` and
  `publish-wizard` publish on every push to main.
- `release-npm`, `release-worker`, `release-image` and
  `release-runner-image` publish on a `v*` tag, which `npm run release:cut`
  pushes.

Each step runs in a container with no docker daemon, so the two image
workflows build with kaniko.

## Secrets

A pull gets no secrets. Each is sealed to ci.knotless.dev alone, for the
refs named, with `knotless secret knotless://chadtmiller.com/pds.js set
<name> --runner ci.knotless.dev --ref <ref>`:

- `PDSJS_SITE_TOKEN`, an app password for pdsjs.dev, to main and `v*` tags.
  The mirror, the sites, the worker artifacts and the PDS registry copies
  use it.
- `NPM_TOKEN`, an npm automation token with publish rights for the
  `@pdsjs` scope, to `v*` tags.
- `RELEASE_PASSWORD`, an app password for chadtmiller.com, to `v*` tags.
  The image workflows publish the images with it, as the repository's
  owner.

A workflow that is not granted a secret it needs fails at its first step
and says which one.