Deploy from GitHub

name: Deploy site to Manybases

# Runs on every push to main, and on demand from the Actions tab.
#
# NOT on pull_request, on purpose: a pull request opened from this same
# repository can ask for the same deployment token, so it would deploy its
# own build over your live site before anyone reviewed it.
on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest

    # Writing this block switches this job's built-in token to a closed
    # list: anything not named here is denied. Both lines are needed.
    permissions:
      # actions/checkout reads your repository with that token. Without
      # this line the very first step of the job fails.
      contents: read
      # And this is the line that lets the runner ask for a deployment
      # token. Without it, the two variables read below do not exist.
      id-token: write

    env:
      PROJECT_ID: proj_XXXXXXXXXXXXXXXXXXXXXXXXXX   # your project id
      API: https://api.manybases.com
      # The folder your build writes into. Change it to match your tool:
      # vite and astro use dist, next with static export uses out.
      BUILD_DIR: dist
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm

      # Two literal commands, never a command held in a variable:
      # running a variable is an injection waiting to happen.
      - run: npm ci
      - run: npm run build

      - name: Upload the built site to Manybases
        run: |
          # Nothing to store anywhere. GitHub signs a short-lived token that
          # names this repository, and Manybases accepts it because you
          # linked that repository to this project.
          #
          # It is asked for HERE, inside the step that uses it, and never
          # handed to a later step: a value written to a step output or to
          # the job environment lands on the runner disk and stays readable
          # by everything that runs after it. This one lives in a shell
          # variable that dies with this step.
          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]; then
            echo "::error::this job cannot ask for a token - check that the permissions block above still says id-token: write"
            exit 1
          fi

          # jq ships on ubuntu-latest. If you changed runs-on, make sure
          # curl and jq exist there, or this stops on the check below.
          answer=$(curl -sS -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://api.manybases.com")
          TOKEN=$(printf "%s" "${answer}" | jq -r ".value" 2>/dev/null || true)
          if [ -z "${TOKEN}" ] || [ "${TOKEN}" = "null" ]; then
            echo "::error::GitHub did not return a deployment token - check the permissions block above, and that curl and jq exist on this runner"
            exit 1
          fi
          # Masked before it can reach a log by any path. The answer that
          # carries it is never printed either.
          echo "::add-mask::${TOKEN}"

          cd "${BUILD_DIR}"

          # One multipart part per file. The part filename carries the path
          # inside the site, and the part content type is what will be served.
          # curl -F on a regular file computes and sends Content-Length, which
          # the API requires: it refuses a chunked body outright.
          args=()
          n=0
          while IFS= read -r -d '' f; do
            rel="${f#./}"
            case "${rel}" in
              *.html) mime=text/html ;;
              *.css)  mime=text/css ;;
              *.js|*.mjs) mime=text/javascript ;;
              *.json) mime=application/json ;;
              *.svg)  mime=image/svg+xml ;;
              *.png)  mime=image/png ;;
              *.jpg|*.jpeg) mime=image/jpeg ;;
              *.webp) mime=image/webp ;;
              *.avif) mime=image/avif ;;
              *.gif)  mime=image/gif ;;
              *.ico)  mime=image/x-icon ;;
              *.woff2) mime=font/woff2 ;;
              *.woff) mime=font/woff ;;
              *.txt)  mime=text/plain ;;
              *.xml)  mime=application/xml ;;
              *.webmanifest) mime=application/manifest+json ;;
              *.map)  mime=application/json ;;
              # Anything else is served as bytes. Add a line above if your
              # site needs a type this list does not cover.
              *) mime=application/octet-stream ;;
            esac
            args+=(-F "f${n}=@${f};filename=/${rel};type=${mime}")
            n=$((n + 1))
          done < <(find . -type f -print0)

          if [ "${n}" -eq 0 ]; then
            echo "::error::no files found in ${BUILD_DIR} — did the build run?"
            exit 1
          fi
          echo "uploading ${n} file(s) to project ${PROJECT_ID}"

          # The body goes to a temporary file OUTSIDE this folder: we are
          # standing inside the directory that is about to be published, and
          # anything written here becomes a page of your site.
          answer_file=$(mktemp)

          # And the response headers go to a second one. That is where the
          # request id lives: the body of a refusal does not carry it, and
          # without it you have nothing to give support - or to match against
          # the Request id column of the Deployments screen.
          headers_file=$(mktemp)

          # Read BOTH the status and the body: on a refusal the API names the
          # offending file, and a job that only checked curl's exit code would
          # go green on a 413.
          set +e
          code=$(curl -sS -X PUT "${API}/v1/projects/${PROJECT_ID}/site" \
            -H "Authorization: Bearer ${TOKEN}" \
            "${args[@]}" \
            -D "${headers_file}" -o "${answer_file}" -w "%{http_code}")
          rc=$?
          set -e

          if [ "${rc}" -ne 0 ]; then
            echo "::error::curl failed (exit ${rc})"
            exit 1
          fi
          cat "${answer_file}"
          echo

          # The header name is case-insensitive and the line ends with CR on
          # HTTP/1.1, so both are handled here rather than trusted.
          request_id=$(tr -d "\r" < "${headers_file}" | awk 'tolower($1)=="x-request-id:"{print $2}')
          echo "manybases request id: ${request_id}"
          if [ "${code}" != "200" ]; then
            echo "::error::Manybases refused the deployment (HTTP ${code}, request id ${request_id}) — see the message above"
            exit 1
          fi
          echo "site deployed"