johnandersen777.bsky.social/knotless

Switch repository

Loading…

# Publishes the lexicons as atproto resolves them, once main's checks
# pass at a commit that changes them, with the shared publish-lexicons
# step (chadtmiller.com/steps): the `_lexicon.<authority>` TXT records in
# the knotless.dev zone, naming lexicons.knotless.dev, and a
# com.atproto.lexicon.schema record there for each lexicon. What is new or
# changed is written, and what main no longer has is deleted, schemas and
# the records of authorities none uses now. Each run makes the whole set
# match main, so a run cut off by a newer one leaves nothing the next does
# not finish.
#
# lexicons.knotless.dev is an account of its own, on a pds.js worker
# (knotless-lexicons-pds), so that what CI holds writes lexicons and
# nothing else. LEX_PASSWORD is an app password of it, granted to pushes
# to main alone in the runner's secrets file. The DNS it reads as
# resolvers see it, and changes only with CLOUDFLARE_API_TOKEN, a token
# with Zone:DNS:Edit on knotless.dev that the host's address may use: it
# is needed only when an authority is added or dropped, and is not
# granted now, so such a run writes the schemas, then fails, saying which
# record to make.
#
# It starts only once main's seven checks have passed at its commit
# (`after`), holding no job while it waits, so the checks are never kept
# from one. Asked for on any other branch, `knotless run rerun <repo>
# --ref refs/heads/<branch> --workflow publish-lexicons`, it waits for
# those of them that ran there, plans, and skips the publish, which runs
# at main alone.

# Its secrets are on ci.knotless.dev alone, the runner that runs no one
# else's code (deploy/runner-host/README.md, The trusted runner).
runners: [ci.knotless.dev]
on:
  push: {refs: [refs/heads/main], paths: [lexicons/**, .knotless/workflows/publish-lexicons.yml]}
  asked: {refs: [refs/heads/*]}
after: [check, test, web, lexicons, shots, docs, e2e]
image: node:24.22.1
secrets: [LEX_PASSWORD, CLOUDFLARE_API_TOKEN]
env:
  KNOTLESS_APPVIEW: https://knotless.dev
  # Cloudflare refuses a token limited to an address over IPv6.
  NODE_OPTIONS: --dns-result-order=ipv4first
steps:
  # What a write would change, with no secrets.
  - uses: chadtmiller.com/steps/publish-lexicons@1
    name: plan
    with: {did: "did:plc:yqsg7znbbhfmj3a2nrpnaerk", zone: knotless.dev}
  - uses: chadtmiller.com/steps/publish-lexicons@1
    name: publish
    on: {refs: [refs/heads/main]}
    with: {did: "did:plc:yqsg7znbbhfmj3a2nrpnaerk", zone: knotless.dev, write: "true"}
    secrets: [LEX_PASSWORD, CLOUDFLARE_API_TOKEN]