release.yml

name: Notion->Crowdin->Publish
on:
  workflow_dispatch:
    inputs:
      pull_notion:
        description: "Pull from Notion"
        type: boolean
        default: true
      download_ref_docs:
        description: "Download ref-docs"
        type: boolean
        default: false
      convert_ref_docs:
        description: "Convert ref-docs to Markdown"
        type: boolean
        default: false
      ref_docs_incremental:
        description: "Use incremental conversion for ref-docs"
        type: boolean
        default: false
      generate_pdfs:
        description: "Generate and upload PDFs"
        type: boolean
        default: true
      update_algolia:
        description: "Update Algolia search index (beware monthly limit)"
        type: boolean
        default: false
      logLevel:
        description: "Log level"
        required: true
        default: "warning"
jobs:
  pull-content:
    uses: ./.github/workflows/pull-content.yml
    secrets: inherit
    with:
      pull_notion: ${{ inputs.pull_notion == true }}
      download_ref_docs: ${{ inputs.download_ref_docs == true }}
      convert_ref_docs: ${{ inputs.convert_ref_docs == true }}
      ref_docs_incremental: ${{ inputs.ref_docs_incremental == true }}

  release:
    name: Release
    runs-on: ubuntu-latest
    needs: pull-content
    env:
      GENERATE_PDFS: ${{ inputs.generate_pdfs }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Sync to latest branch state
        run: |
          git fetch --prune origin
          if [ "${{ github.ref_type }}" = "branch" ]; then
            git reset --hard origin/${{ github.ref_name }}
          else
            git checkout ${{ github.ref }}
          fi
      - name: Install Node.js as specified in package.json
        uses: volta-cli/action@v5
      - name: Install pnpm
        uses: pnpm/action-setup@v5
        with:
          version: 10.33.4
          cache: true
          run_install: false
      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # We don't have enough translated yet to make it even worth downloading and processing the translations.
      # For now, we skip (comment out) those bits.
      # When reinstating this, be sure to also
      #  - reenable pdf uploads for fr and es below and in other GHA workflow files
      #  - turn on the relevant locales in docusaurus.config.js
      #  - create (or duplicate from English) localized pdfs in make-pdf.sh

      # - name: Crowdin
      #   run: pnpm crowdin:sync
      #   env:
      #     SIL_BLOOM_DOCS_CROWDIN_TOKEN: ${{ secrets.SIL_BLOOM_DOCS_CROWDIN_TOKEN }}
      # - name: Commit New Translations
      #   uses: stefanzweifel/git-auto-commit-action@v7
      #   with:
      #     commit_message: GHAction - Commit incoming translations from Crowdin

      - name: Build Docusaurus instance
        run: pnpm build
      - name: Set S3 Bucket
        id: set-bucket
        run: |
          if [ "${{ github.ref }}" == "refs/heads/alpha" ]; then
            BUCKET="${{ secrets.AWS_BUCKET_ALPHA }}"
          else
            BUCKET="${{ secrets.AWS_BUCKET }}"
          fi
          echo "::add-mask::$BUCKET"
          echo "bucket=$BUCKET" >> $GITHUB_OUTPUT
        shell: bash
      - name: Upload S3
        # We exclude these five paths because they existed before the current system.
        # The five index.html files contain redirects. One is to an external document; the others to pages at docs.bloomlibrary.org.
        # See more detailed notes at https://docs.google.com/document/d/1Vub0SeQL6BQqyGoQBN6-cfi6AIRbcBHeV87KjnzZXDU/edit#heading=h.aaxpksot3akz.
        run: aws s3 sync ./build  s3://${{ steps.set-bucket.outputs.bucket }} --delete --exclude "sil-corporate-guidelines/index.html" --exclude "bloom-reader-shelves/index.html" --exclude "team-collections-sharing-services/index.html" --exclude "team-collections/index.html" --exclude "widgets/index.html"
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: "us-east-1"
      - name: Disable AppArmor
        if: ${{ env.GENERATE_PDFS == 'true' }}
        # Ubuntu >= 23 has AppArmor enabled by default, which breaks Puppeteer.
        # See https://github.com/puppeteer/puppeteer/issues/12818 "No usable sandbox!"
        # this is taken from the solution used in Puppeteer's own CI: https://github.com/puppeteer/puppeteer/pull/13196
        # The alternative is to pin Ubuntu 22 or to use aa-exec to disable AppArmor for commands that need Puppeteer.
        # This is also suggested by Chromium https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md
        run: echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns
        shell: bash
      - name: Install Chrome for PDF generation
        run: pnpm exec puppeteer browsers install chrome
      # Serve the built site locally for PDF generation instead of using the live site.
      # This avoids S3 costs and potential timeouts.
      - name: Start local server for PDF generation
        if: ${{ env.GENERATE_PDFS == 'true' }}
        run: |
          pnpm serve --port 3000 &
          echo $! > server.pid
          # Wait for server to be ready
          for i in {1..30}; do
            if curl -s http://localhost:3000 > /dev/null; then
              echo "Server is ready"
              break
            fi
            echo "Waiting for server to start... ($i/30)"
            sleep 1
          done
        shell: bash
      - name: Generate PDFs
        if: ${{ env.GENERATE_PDFS == 'true' }}
        run: pnpm make-pdf
      - name: Upload PDFs to S3
        if: ${{ env.GENERATE_PDFS == 'true' }}
        run: |
          aws s3 cp ./build/downloads/ s3://${{ steps.set-bucket.outputs.bucket }}/downloads/ --recursive --exclude "*" --include "*.pdf"
          # aws s3 cp ./build/fr/downloads/ s3://${{ steps.set-bucket.outputs.bucket }}/fr/downloads/ --recursive --exclude "*" --include "*.pdf"
          # aws s3 cp ./build/es/downloads/ s3://${{ steps.set-bucket.outputs.bucket }}/es/downloads/ --recursive --exclude "*" --include "*.pdf"
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: "us-east-1"
      - name: Cloudflare - purge cache for PDFs
        if: ${{ env.GENERATE_PDFS == 'true' }}
        uses: jakejarvis/cloudflare-purge-action@v0.3.0
        env:
          CLOUDFLARE_ZONE: ${{ secrets.CLOUDFLARE_ZONE }}
          CLOUDFLARE_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
          PURGE_URLS: '["https://${{ steps.set-bucket.outputs.bucket }}/downloads/docs-bloomlibrary-english-a4.pdf", "https://${{ steps.set-bucket.outputs.bucket }}/fr/downloads/docs-bloomlibrary-english-a4.pdf", "https://${{ steps.set-bucket.outputs.bucket }}/es/downloads/docs-bloomlibrary-english-a4.pdf"]'

  update-algolia:
    if: ${{ inputs.update_algolia }}
    uses: ./.github/workflows/update-algolia.yml
    secrets: inherit
    needs: release