@@ -20,6 +20,10 @@ inputs:
2020 cloudflare-zone :
2121 description : The Cloudflare zone to purge.
2222 required : false
23+ external-https :
24+ description : Whether HTTPS is set up externally, e.g. on Cloudflare instead of GitHub.
25+ default : false
26+ required : false
2327outputs :
2428 url :
2529 description : The URL to which the site was deployed
4145 id : pages
4246 uses : actions/configure-pages@v5
4347
48+ - name : set base URL
49+ shell : bash
50+ run : |
51+ base_url="${{ steps.pages.outputs.base_url }}"
52+ if [ "${{ inputs.external-https }}" = true ] ; then
53+ base_url="$(echo "$base_url" | sed 's/^http:/https:/')"
54+ fi
55+ echo "base_url=$base_url" >>"$GITHUB_ENV"
56+
4457name : configure Hugo and Pagefind version
4558 shell : bash
4659 run : |
5972 env :
6073 HUGO_RELATIVEURLS : false
6174 shell : bash
62- run : hugo config && hugo --baseURL "${{ steps.pages.outputs .base_url }}/"
75+ run : hugo config && hugo --baseURL "${{ env .base_url }}/"
6376
6477 - name : run Pagefind ${{ env.PAGEFIND_VERSION }} to build the search index
6578 shell : bash
@@ -110,7 +123,6 @@ runs:
110123 id : remap
111124 shell : bash
112125 run : |
113- base_url='${{ steps.pages.outputs.base_url }}'
114126 echo "result=$(echo "$base_url" |
115127 sed 's|^\(.*\)\(/git-scm\.com\)$|(\1)?\2(.*)|') file://$PWD/public\$2" \
116128 >>$GITHUB_OUTPUT
@@ -120,14 +132,25 @@ runs:
120132 sed -n 's|^\(https\?:\/\/.*\)\(/git-scm\.com\)$|--remap '\''(\1.*) file://../$1'\''|p')" \
121133 >>$GITHUB_OUTPUT
122134
135+ name : check for downgrades to unencrypted HTTP
136+ if : startsWith(env.base_url, 'https://')
137+ shell : bash
138+ # The `--require-https` option of lychee could come in handy,
139+ # but it also complains about `http://` links to other sites,
140+ # and (more importantly) doesn't work in offline mode.
141+ # A simple `grep` should work without any false positives,
142+ # unless git-scm.com mentions the base URL of one of its forks,
143+ # which is unlikely.
144+ run : ' ! grep -FInr "http:${base_url#https:}" public'
145+
123146 - name : check for broken links
124147 id : lychee
125148 uses : lycheeverse/lychee-action@v2
126149 with :
127150 args : >-
128151 --offline
129152 --fallback-extensions html
130- --base '${{ steps.pages.outputs .base_url }}'
153+ --base '${{ env .base_url }}'
131154 --remap '${{ steps.remap.outputs.result }}'
132155 ${{ steps.remap.outputs.remap-dotdot }}
133156 --exclude file:///path/to/repo.git/
@@ -192,23 +215,21 @@ runs:
192215name : Install @playwright/test
193216 shell : bash
194217 run : npm install @playwright/test
195- - name : Edit /etc/hosts to map git-scm.com to GitHub
218+ - name : Edit /etc/hosts to map the deployed domain to GitHub
196219 shell : bash
197- # This side-steps the Cloudflare caches
198- run : sudo sh -c 'echo "185.199.108.153 git-scm.com" >>/etc/hosts'
220+ # This side-steps any caches that might be configured on the domain,
221+ # and works even when the real server is not reachable from GitHub.
222+ run : |
223+ host="$(echo "$base_url" | sed -E 's|^https?://([^:/]+).*|\1|')"
224+ sudo sh -c "echo '185.199.108.153 $host' >>/etc/hosts"
199225name : Run Playwright tests
200226 shell : bash
201227 id : playwright
202228 env :
203- PLAYWRIGHT_TEST_URL : ${{ steps.pages.outputs.base_url }}
204- run : |
229+ PLAYWRIGHT_TEST_URL : ${{ env.base_url }}
205230 # avoid test failures when HTTPS is enforced half-way through
206- case "$PLAYWRIGHT_TEST_URL" in
207- https://*|http://git-scm.com) ;; # okay, leave as-is
208- http://*) PLAYWRIGHT_TEST_URL="https://${PLAYWRIGHT_TEST_URL#http://}";;
209- esac &&
210- echo "result=$PLAYWRIGHT_TEST_URL" >>$GITHUB_OUTPUT &&
211- npx playwright test --project=chrome
231+ PLAYWRIGHT_EXTERNAL_HTTPS : ${{ inputs.external-https }}
232+ run : npx playwright test --project=chrome
212233 - uses : actions/upload-artifact@v4
213234 if : always() && steps.playwright.outputs.result != ''
214235 with :
0 commit comments