Skip to content

fix(ci): pin mkdocs-monorepo-plugin to a commit SHA and split Pages deploy - #173

Open
nouraellm wants to merge 1 commit into
OWASP:masterfrom
nouraellm:fix/pin-docs-deps-and-split-pages-deploy
Open

fix(ci): pin mkdocs-monorepo-plugin to a commit SHA and split Pages deploy#173
nouraellm wants to merge 1 commit into
OWASP:masterfrom
nouraellm:fix/pin-docs-deps-and-split-pages-deploy

Conversation

@nouraellm

Copy link
Copy Markdown

Why

CI and the Dockerfile install PauloASilva/mkdocs-monorepo-plugin@feat/i18n (mutable branch) and CI then runs mkdocs gh-deploy --force with contents: write.

What

  • Add requirements.txt pinning mkdocs-material==9.0.9 and the plugin to 63f18e2f87aead69883745a0a4808c275005b0f7.
  • Point Dockerfile at that file.
  • Split the workflow: build (contents: read, mkdocs build) and deploy (pages: write, id-token: write, actions/deploy-pages).
  • Pin Actions by SHA.

Maintainer note

actions/deploy-pages needs Settings → Pages → Source = GitHub Actions. I cannot change that from a fork. Please flip it before or when merging, or the first deploy will fail while the repo is still on branch/gh-pages. If feat/i18n must move later, bump the SHA in requirements.txt in a reviewed commit; do not restore a branch ref.

fixes #168

…eploy

Why

CI and the Dockerfile install `PauloASilva/mkdocs-monorepo-plugin@feat/i18n` (mutable branch) and CI then runs `mkdocs gh-deploy --force` with `contents: write`.

What

- Add `requirements.txt` pinning `mkdocs-material==9.0.9` and the plugin to `63f18e2f87aead69883745a0a4808c275005b0f7`.
- Point `Dockerfile` at that file.
- Split the workflow: `build` (`contents: read`, `mkdocs build`) and `deploy` (`pages: write`, `id-token: write`, `actions/deploy-pages`).
- Pin Actions by SHA.

Maintainer note

`actions/deploy-pages` needs **Settings → Pages → Source = GitHub Actions**. I cannot change that from a fork. Please flip it before or when merging, or the first deploy will fail while the repo is still on branch/`gh-pages`. If `feat/i18n` must move later, bump the SHA in `requirements.txt` in a reviewed commit; do not restore a branch ref.

fixes OWASP#168
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Unpinned third-party MkDocs plugin from a personal feat/* branch is executed in docs deploy with contents:write

1 participant