publish.yml

name: TUF-on-CI publish

permissions: {}

on:
  workflow_dispatch:
    inputs:
      ref:
        type: string
        required: false

jobs:
  build:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - id: build-and-upload-repository
        uses: theupdateframework/tuf-on-ci/actions/upload-repository@27c49c016591c7cfea57f6b15296f714a5c4a5f6 # v0.13.0
        with:
          gh_pages: true
          ref: ${{ inputs.ref }}

  deploy-to-pages:
    permissions:
      pages: write
      id-token: write # for authenticating to GH Pages
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Deploy TUF-on-CI repository to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

  test-deployed-repository:
    needs: deploy-to-pages
    permissions:
      issues: 'write' # for modifying Issues
    uses: ./.github/workflows/test.yml

  update-issue:
    runs-on: ubuntu-latest
    needs: [build, deploy-to-pages, test-deployed-repository]
    if: always() && !cancelled()
    permissions:
      issues: 'write' # for modifying Issues
    steps:
      - name: Update the issue for the workflow
        uses: theupdateframework/tuf-on-ci/actions/update-issue@27c49c016591c7cfea57f6b15296f714a5c4a5f6 # v0.13.0
        with:
          token: ${{ secrets.TUF_ON_CI_TOKEN || secrets.GITHUB_TOKEN }}
          success: ${{ !contains(needs.*.result, 'failure') }}