Workflows

knotless.dev's runners run these for chadtmiller.com/pds.js: ci on the hosted runner, runner.knotless.dev, and every workflow given a secret on ci.knotless.dev, the runner on knotless.dev's own host, each naming its runner in runners. The format is in knotless's workflow reference. The runner reads only the .yml, .yaml and .json files here. Each workflow says what it does, and why, in its comments.

• ci is the gate, on every branch and on pulls into main.
• mirror-repo pushes main and each v* tag to atproto://pdsjs.dev/pds.js.
• canary-worker, publish-git-app, publish-spaces-app and publish-wizard publish on every push to main.
• release-npm, release-worker, release-image and release-runner-image publish on a v* tag, which npm run release:cut pushes.

Each step runs in a container with no docker daemon, so the two image workflows build with kaniko.

Secrets

A pull gets no secrets. Each is sealed to ci.knotless.dev alone, for the refs named, with knotless secret knotless://chadtmiller.com/pds.js set <name> --runner ci.knotless.dev --ref <ref>:

• PDSJS_SITE_TOKEN, an app password for pdsjs.dev, to main and v* tags. The mirror, the sites, the worker artifacts and the PDS registry copies use it.
• NPM_TOKEN, an npm automation token with publish rights for the @pdsjs scope, to v* tags.
• RELEASE_PASSWORD, an app password for chadtmiller.com, to v* tags. The image workflows publish the images with it, as the repository's owner.

A workflow that is not granted a secret it needs fails at its first step and says which one.