Add GitHub Actions workflow to build PDFs with decktape#14
Merged
Conversation
On every push to main that touches security-in-age-of-ai/, build a PDF from the Reveal.js deck using decktape and commit it back to the same directory. PDF is also uploaded as a workflow artifact.
Pin to full 40-char commit SHAs with tag comment, matching the deck's own guidance on hijack-resistant action references.
Deploying presentations with
|
| Latest commit: |
dbaddb8
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://1df4b9f6.presentations-73a.pages.dev |
| Branch Preview URL: | https://add-pdf-build-workflow.presentations-73a.pages.dev |
Install decktape from astefanutti/decktape at commit 6735cec (v3.12.0) so a retagged release on GitHub or npm can't substitute different code.
Enable pnpm via Corepack and switch decktape install + http-server / wait-on invocations from npm/npx to pnpm / pnpm dlx.
- build: read-only permissions, runs on every PR and push to verify the deck still renders to PDF; uploads PDF as a workflow artifact. - publish: gated by 'push to main', needs: build. Downloads the verified artifact and commits it back. Never sees source or runs build code. Mirrors the same two-job split the deck recommends for release pipelines.
Set PNPM_HOME and add it to PATH so 'pnpm add -g' has a valid global bin directory. Without this, pnpm errors with ERR_PNPM_NO_GLOBAL_BIN_DIR.
GitHub-hosted Ubuntu runners can't use Chrome's SUID sandbox, so puppeteer fails with 'No usable sandbox'. Disabling it is safe inside the ephemeral runner.
- New scripts/zenodo_publish.py uploads the PDF to the uw-ssec community on zenodo.org (or sandbox.zenodo.org when ZENODO_SANDBOX is set). First run creates a new deposition; later runs open a new version of the existing record and replace the file. Existing records are discovered by searching the authenticated user's depositions for a unique 'uw-ssec-deck:<slug>' keyword tag. - Per-deck metadata lives in <deck>/zenodo.json so adding another deck is just adding a JSON file plus a publish step. - Workflow publish job no longer commits; runs the script with ZENODO_TOKEN from secrets, defaults to sandbox so production records aren't created until ZENODO_SANDBOX repo var is set to 'false'. - Skips publish when the existing record's version already matches github.sha.
Replaces the git-SHA version with a calendar version computed at publish time in UTC. When more than one publish happens on the same day, the version becomes YYYY.MM.DD.N with N incremented from the previous record's version.
- Workflow now also triggers on push to 'staging'.
- The publish job runs on either main or staging, but selects the
Zenodo host and token based on which branch fired:
staging → sandbox.zenodo.org via ZENODO_SANDBOX_TOKEN
main → zenodo.org via ZENODO_TOKEN
- Drops the vars.ZENODO_SANDBOX override; branch decides.
Lets each deck pick its own community without editing the script. Defaults to 'uw-ssec' when unset.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
.github/workflows/build-pdf.yml: on every push tomainthat touchessecurity-in-age-of-ai/, build a PDF of the Reveal.js deck with decktape and commit it back to the same directory. The PDF is also uploaded as a workflow artifact for the run.Mirrors the deck's own recommendations:
permissions: {}at workflow level, per-job opt-in[email protected])Test plan
main; verify the workflow runs and producessecurity-in-age-of-ai/security-in-age-of-ai.pdfworkflow_dispatchto rebuild on demand