Skip to content

docs(ci) Publish the Rust prose tree to libtmux.org - #24

Open
tony wants to merge 4 commits into
masterfrom
docs-site
Open

tony wants to merge 4 commits into
masterfrom
docs-site

Conversation

@tony

@tony tony commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

libtmux.org links /en/rs/latest/ from the port switcher and the sidebar of every page, and nothing has ever published there — the URL 403s today. This adds the workflow that publishes it.

What builds it

Not this repository. libtmux/docs's scripts/build-site.sh renders the shared concepts, guides and examples with Rust in every code fence, reading this checkout for the example sources those pages quote (crates/libtmux/examples/scratch.rs, including its region: capture marker). So the job checks out both repositories and points LIBTMUX_DOCS_CHECKOUT_RS at this one.

That override did not exist until today. Without it the build resolves a developer's home directory, finds nothing, and fails on every inlined example — which is why no port could publish from CI before.

docs.rs remains the canonical Rust API reference; nothing here changes that. An ecosystemHost says where a port's reference lives, not whether the port publishes prose.

Deliberately conservative

No port has published through this workflow yet. So: trunk only, at rs/latest, with is-default: false — the tree is reachable and linkable, stays out of the search index, and the bare port root keeps falling through to the landing page until the shape is proven.

Both references to libtmux/docs pin one full-length commit SHA with the release name in a trailing comment, rather than a tag. This repository runs that repository's build script under a role that can write the live bucket, and a tag can be repointed. They must be bumped together — the actions/checkout governs what runs, the uses: governs the publish contract, and drifting them is silent.

Set up already

  • IAM role libtmux-org-rs-publisher, trusting repo:libtmux@316212987/libtmux-rs@1335091249:environment:docs, scoped to en/rs/*, ja/rs/* and manifest/rs.json
  • LIBTMUX_DOCS_ROLE_ARN, LIBTMUX_DOCS_BUCKET, LIBTMUX_DOCS_DISTRIBUTION set on this repository

Known gaps

  • Untested. The first execution is the merge; no PR check exercises the deploy.
  • The docs environment does not exist yet. GitHub creates it on first run, without protection rules — the deployment branch policy is what actually restricts which refs may publish, and it should be added after the first green run.
  • Authored by the libtmux/docs session with Tony's authorization, not by the Rust session, which reviewed the shape and declined to self-author it.

@tony

tony commented Sep 6, 2026

Copy link
Copy Markdown
Contributor Author

Reviewed the shape against this repo's conventions rather than re-deriving it. Two things, one of them a convention this repo holds without exception, and one verification worth recording.

build has no timeout-minutes. Every job in ci.yml sets one (45/30/20/30/90) and both in release.yml set 45. This is the only job in the repository without a ceiling, and it is the one that runs pnpm install against a network. The publish job correctly omits it, since a caller cannot set a timeout on a reusable workflow.

upload-artifact defaults if-no-files-found to warn. A build that produces an empty docs/_site/en/rs/latest then uploads an empty artifact, publish syncs nothing, and the run is green — the failure mode reports success, which is the direction that costs most on a workflow whose first execution is the merge. if-no-files-found: error makes it fail where the mistake is.

queue: max is correct, and actionlint is wrong to flag it. Verified against GitHub's workflow-syntax reference rather than by analogy: concurrency accepts group, cancel-in-progress and queue; queue takes single (the default, at most one pending run) or max (up to 100 pending). It cannot be combined with cancel-in-progress: true, and this workflow does not.

Everything else matches what I had on file and reads correctly to me: both refs to libtmux/docs name the same full-length SHA with the release as a trailing comment, path-prefix is unprefixed by locale, the artifact is the latest directory rather than its parent, is-default: false, permissions least-privilege with id-token: write only on publish, and the four action versions all exist (checkout v7.0.1, setup-node v7.0.0, upload-artifact v7.0.1, pnpm/action-setup v6.1.0). Tag pinning matches the rest of this repo, which pins by tag rather than SHA for third-party actions.

Not blocking from me — the decision to merge is Tony's, and the two known gaps in the description (no check exercises the deploy, and the auto-created docs environment has no branch policy until one is added) are stated accurately.

Tony Narlock added 4 commits September 8, 2026 18:28
libtmux.org links /en/rs/latest/ from the port switcher and the sidebar of
every page, and nothing has ever published there — the URL 403s today.
This is what publishes it.

The tree is built by libtmux/docs's own assembly rather than by anything
here: build-site.sh renders the shared concepts, guides and examples with
Rust in every code fence, reading this checkout for the example sources
those pages quote. So the job checks out both repositories and points
LIBTMUX_DOCS_CHECKOUT_RS at this one. Without that override the build
resolves a developer's home directory, finds nothing, and fails on every
inlined example.

docs.rs remains the canonical Rust API reference and nothing here changes
that. An ecosystem host says where a port's reference lives, not whether
the port publishes prose.

Both references to libtmux/docs pin one full-length commit SHA rather
than a tag, with the release name in a trailing comment: this repository
runs that repository's build script under a role that writes the live
bucket, and a tag can be repointed. They must be bumped together.

Temporary and deliberately conservative: no port has published through
this workflow yet, so it publishes trunk at rs/latest with is-default
false — reachable and linkable, kept out of the search index, and the
bare port root still falls through to the landing page until the shape is
proven.
/en/rs/latest/ 403s on the live site — nothing has ever published under a
port version prefix, so every versioned port link from libtmux.org lands
on an S3 AccessDenied page. This lets the branch publish without merging,
filling that tree and exercising the whole path for the first time: OIDC
subject, role scoping, prefix handling, manifest upsert.

Temporary by construction. Drop `docs-site` from the trigger in the same
change that merges to master — otherwise an unreviewed commit on a docs
branch can overwrite the published tree.
First publish attempt failed at pnpm/action-setup: "No pnpm version is
specified". The action reads `packageManager` from the repository root by
default, and this repository has no package.json — the one pinning
pnpm@11.21.0 belongs to the libtmux/docs checkout, which the job places
at docs/.

Invisible from libtmux/docs, where that file sits at the root and the
same step needs no input. It only appears once the build runs somewhere
else, which is what this DO NOT MERGE branch exists to find.
The first publish synced the tree but failed upserting manifest/rs.json:
jq precedence made it add an array to an object. Fixed upstream.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant