main.yml

name: Build and deploy to GitHub Pages

on:
  push:
    branches:
      - "master"
  schedule:
    # Every six hours update the web site
    - cron: "0 */6 * * *"
    # Daily rebuild at 3am UTC
    - cron: "0 3 * * *"
  workflow_dispatch:

concurrency:
  group: deploy-master
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true # Fetch Hugo themes (true OR recursive)
          fetch-depth: 0 # Fetch all history for .GitInfo and .Lastmod
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y jq build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev

      - name: Create static/data directory
        run: mkdir -p static/data

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "24.9.0"
          cache: "npm"

      - name: Install npm dependencies
        run: npm ci

      - name: Fetch All Contributors
        run: node scripts/fetch-contributors.js
        env:
          GH_ACCESS_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}

      - name: Combine Contributors
        run: "jq -n 'input | . as $core | (input | . as $homepage | $core + $homepage) | unique_by(.login)' static/data/contributors-core.json static/data/contributors-homepage.json > static/data/contributors.json"

      - name: Fetch donors
        run: |
          CUTOFF_DATE=$(date -d '90 days ago' '+%Y-%m-%d')
          MEMBERS_FILE=$(mktemp)
          DONORS_FILE=$(mktemp static/data/donors.json.XXXXXX)
          PAST_DONORS_FILE=$(mktemp static/data/past-donors.json.XXXXXX)
          trap 'rm -f "$MEMBERS_FILE" "$DONORS_FILE" "$PAST_DONORS_FILE"' EXIT

          if curl --fail --silent --show-error --location --retry 3 --connect-timeout 10 --max-time 60 \
            https://opencollective.com/owncast/members/all.json > "$MEMBERS_FILE" \
            && jq -e 'type == "array"' "$MEMBERS_FILE" >/dev/null \
            && jq --arg cutoff "$CUTOFF_DATE" \
              '[.[] | select(.role == "BACKER" and .lastTransactionAt >= $cutoff) | {login: .name, avatar_url: .image, html_url: .profile}]' \
              "$MEMBERS_FILE" > "$DONORS_FILE" \
            && jq --arg cutoff "$CUTOFF_DATE" \
              '[. as $members
                | [$members[] | select(.role == "BACKER" and .lastTransactionAt >= $cutoff) | .profile] as $current_profiles
                | $members[]
                | select(
                    .role == "BACKER"
                    and (.lastTransactionAt | type) == "string"
                    and .lastTransactionAt < $cutoff
                    and .totalAmountDonated > 0
                    and (.profile as $profile | ($current_profiles | index($profile)) == null)
                  )
                | {login: .name, avatar_url: .image, html_url: .profile}]' \
              "$MEMBERS_FILE" > "$PAST_DONORS_FILE" \
            && jq -e 'length > 0' "$DONORS_FILE" >/dev/null \
            && jq -e 'type == "array"' "$PAST_DONORS_FILE" >/dev/null; then
            mv "$DONORS_FILE" static/data/donors.json
            mv "$PAST_DONORS_FILE" static/data/past-donors.json
          else
            echo "OpenCollective donor data was unavailable or empty; keeping the previous current and past donor lists."
          fi

      - name: Process donors
        run: node scripts/process-donors.js

      - name: Download and resize avatars
        run: node scripts/download-avatars.js

      - name: Generate releases pages
        run: node scripts/fetch-releases.js

      - name: Check if install preview needs regeneration
        id: release_check
        run: |
          latest=$(curl -sf "https://api.github.com/repos/owncast/owncast/releases/latest" \
            -H "Authorization: Bearer ${{ secrets.GH_ACCESS_TOKEN }}" \
            -H "User-Agent: Owncast-Docs-Builder" | jq -r .tag_name)
          stored=$(cat static/owncast-install.version 2>/dev/null || echo "")
          echo "latest=$latest" >> "$GITHUB_OUTPUT"
          if [ "$latest" = "$stored" ]; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "Install preview already at $latest — skipping generator."
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
            echo "Regenerating install preview: '$stored' -> '$latest'"
          fi

      - name: Sync developer documentation
        run: node scripts/fetch-docmost.js
        env:
          DOCMOST_URL: ${{ vars.DOCMOST_URL }}
          DOCMOST_SPACE: ${{ vars.DOCMOST_SPACE }}
          DOCMOST_EMAIL: ${{ vars.DOCMOST_EMAIL }}
          DOCMOST_PASSWORD: ${{ secrets.DOCMOST_PASSWORD }}

      - name: Run preview generator
        if: steps.release_check.outputs.skip != 'true'
        working-directory: scripts/preview-generator
        run: |
          docker build -t owncast-installer-preview-generator .
          docker run --rm -v $PWD:/vhs owncast-installer-preview-generator ./installer.tape
          docker run --rm -v $PWD:/vhs --entrypoint /bin/sh owncast-installer-preview-generator \
            -c 'gifsicle -O3 --careful owncast-install.gif > owncast-install.optimized.gif && mv owncast-install.optimized.gif owncast-install.gif'
          mv owncast-install.* ../../static/
          echo "${{ steps.release_check.outputs.latest }}" > ../../static/owncast-install.version

      - name: Commit changes
        run: |
          generated_dir=$(mktemp -d)
          trap 'rm -rf "$generated_dir"' EXIT
          mkdir -p "$generated_dir"/{releases,dev-docs,src/data,static/data,static}
          cp -a releases/. "$generated_dir/releases/"
          cp -a dev-docs/. "$generated_dir/dev-docs/"
          cp -a src/data/dev-manifest.json "$generated_dir/src/data/"
          cp -a static/data/{contributors.json,donors.json,past-donors.json,contributors-processed.json,donors-processed.json,past-donors-processed.json} "$generated_dir/static/data/"
          if [ "$SKIP_INSTALL_PREVIEW" != "true" ]; then
            cp -a static/owncast-install.* "$generated_dir/static/"
          fi

          for attempt in 1 2 3; do
            git fetch origin master
            git reset --hard origin/master
            git config user.name "Owncast"
            git config user.email "owncast@owncast.online"
            cp -a "$generated_dir"/releases/. releases/
            cp -a "$generated_dir"/dev-docs/. dev-docs/
            cp -a "$generated_dir"/src/data/dev-manifest.json src/data/
            cp -a "$generated_dir"/static/data/. static/data/
            if [ "$SKIP_INSTALL_PREVIEW" != "true" ]; then
              cp -a "$generated_dir"/static/owncast-install.* static/
              git add static/owncast-install.*
            fi
            git add releases/ dev-docs/ src/data/dev-manifest.json static/data/contributors.json static/data/donors.json static/data/past-donors.json static/data/contributors-processed.json static/data/donors-processed.json static/data/past-donors-processed.json
            if git diff --staged --quiet; then
              exit 0
            fi
            git commit -m "Update dynamic content"
            if git push origin HEAD:master; then
              exit 0
            fi
          done
          exit 1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SKIP_INSTALL_PREVIEW: ${{ steps.release_check.outputs.skip }}

      - name: Upload changed source files to Crowdin
        run: npm run crowdin:upload-existing
        env:
          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

      - name: Download Crowdin translations
        run: npm run crowdin:sync
        env:
          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

      - name: Add swap space for the multi-locale build
        run: |
          sudo mkdir -p /mnt
          sudo fallocate -l 8G /mnt/swapfile
          sudo chmod 600 /mnt/swapfile
          sudo mkswap /mnt/swapfile
          sudo swapon /mnt/swapfile
          free -h

      # Build each locale in its own process. A single docusaurus build of all
      # 26 locales accumulates memory until the hosted runner dies.
      # Locales have explicit baseUrls (/de/, /fr/, ...) so docusaurus appends
      # the locale segment to --out-dir itself. Build English first so the
      # on-disk plugin cache (github-info, milestones) is warm before localized
      # builds start. Localized builds run two at a time in parallel; each uses
      # isolated generated and output directories because Docusaurus rewrites
      # locale-specific files in .docusaurus/ at startup.
      - name: Build
        run: |
          npm run prebuild
          locales=$(node -e "const m=require('fs').readFileSync('docusaurus.config.ts','utf8').match(/locales:\s*\[([^\]]*)\]/)[1];console.log([...m.matchAll(/'([^']+)'/g)].map(x=>x[1]).join(' '))")
          echo "Building locales: $locales"
          npx docusaurus build --locale en --out-dir build
          # Released Owncast servers consume this legacy JSON Feed path.
          cp build/news/feed.json build/news/index.json
          localized=()
          for l in $locales; do
            if [ "$l" != "en" ]; then
              localized+=("$l")
            fi
          done
          printf '%s\n' "${localized[@]}" | xargs -r -n 1 -P 2 bash -c '
            locale="$1"
            DOCUSAURUS_GENERATED_FILES_DIR_NAME=".docusaurus-$locale" \
              npx docusaurus build --locale "$locale" --out-dir "build-$locale"
          ' _
          for l in "${localized[@]}"; do
            mv "build-$l/$l" "build/$l"
          done
        env:
          NODE_OPTIONS: --max-old-space-size=6144
          GH_ACCESS_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
          DOCMOST_URL: ${{ vars.DOCMOST_URL }}
          DOCMOST_SPACE: ${{ vars.DOCMOST_SPACE }}
          DOCMOST_EMAIL: ${{ vars.DOCMOST_EMAIL }}
          DOCMOST_PASSWORD: ${{ secrets.DOCMOST_PASSWORD }}

      # Deploy to DigitalOcean Spaces
      # Released Owncast servers fetch the public news feed cross-origin.
      - name: Configure Spaces CORS
        run: |
          aws s3api put-bucket-cors \
            --bucket "$AWS_S3_BUCKET" \
            --cors-configuration '{"CORSRules":[{"AllowedOrigins":["*"],"AllowedMethods":["GET","HEAD"],"AllowedHeaders":["*"],"MaxAgeSeconds":3600}]}' \
            --endpoint-url "$AWS_S3_ENDPOINT"
        env:
          AWS_S3_BUCKET: ${{ secrets.DO_SPACES_BUCKET }}
          AWS_ACCESS_KEY_ID: ${{ secrets.DO_SPACES_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.DO_SPACES_SECRET }}
          AWS_REGION: ${{ secrets.DO_SPACES_REGION }}
          AWS_S3_ENDPOINT: https://${{ secrets.DO_SPACES_REGION }}.digitaloceanspaces.com

      # Upload non-HTML assets (long cache)
      - name: Upload assets
        uses: jakejarvis/s3-sync-action@v0.5.1
        with:
          args: --exclude '*.html' --cache-control 'public,max-age=31536000,immutable' --acl public-read
        env:
          AWS_S3_BUCKET: ${{ secrets.DO_SPACES_BUCKET }}
          AWS_ACCESS_KEY_ID: ${{ secrets.DO_SPACES_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.DO_SPACES_SECRET }}
          AWS_REGION: ${{ secrets.DO_SPACES_REGION }}
          AWS_S3_ENDPOINT: https://${{ secrets.DO_SPACES_REGION }}.digitaloceanspaces.com
          SOURCE_DIR: build

      # Upload HTML (short cache)
      - name: Upload HTML (short cache)
        uses: jakejarvis/s3-sync-action@v0.5.1
        with:
          args: --exclude '*' --include '*.html' --cache-control 'public,max-age=60' --acl public-read
        env:
          AWS_S3_BUCKET: ${{ secrets.DO_SPACES_BUCKET }}
          AWS_ACCESS_KEY_ID: ${{ secrets.DO_SPACES_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.DO_SPACES_SECRET }}
          AWS_REGION: ${{ secrets.DO_SPACES_REGION }}
          AWS_S3_ENDPOINT: https://${{ secrets.DO_SPACES_REGION }}.digitaloceanspaces.com
          SOURCE_DIR: build

      # Release slugs contain dots, so Fastly treats clean URLs as file keys.
      - name: Generate extensionless release aliases
        run: |
          for page in build/releases/owncast-*/index.html build/*/releases/owncast-*/index.html; do
            [ -f "$page" ] || continue
            target="release-aliases/${page#build/}"
            target="${target%/index.html}"
            mkdir -p "$(dirname "$target")"
            cp "$page" "$target"
          done

      - name: Upload extensionless release aliases
        uses: jakejarvis/s3-sync-action@v0.5.1
        with:
          args: --content-type text/html --cache-control 'public,max-age=60' --acl public-read
        env:
          AWS_S3_BUCKET: ${{ secrets.DO_SPACES_BUCKET }}
          AWS_ACCESS_KEY_ID: ${{ secrets.DO_SPACES_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.DO_SPACES_SECRET }}
          AWS_REGION: ${{ secrets.DO_SPACES_REGION }}
          AWS_S3_ENDPOINT: https://${{ secrets.DO_SPACES_REGION }}.digitaloceanspaces.com
          SOURCE_DIR: release-aliases

      # Purge Fastly cache
      #
      # Recommended: soft purge so users get instant fresh content when needed,
      # while allowing Fastly to serve stale during revalidation.
      - name: Purge Fastly
        uses: yukukotani/fastly-purge-action@v1
        with:
          api-token: ${{ secrets.FASTLY_API_TOKEN }}
          service-id: ${{ secrets.FASTLY_SERVICE_ID }}
          target: surrogate-key
          keys: docs-html,docs-static
          soft: true

      # - name: Deploy
      #   uses: peaceiris/actions-gh-pages@v4
      #   with:
      #     github_token: ${{ secrets.GITHUB_TOKEN }}
      #     publish_dir: ./public