Skip to content

ci(docs): build on pull requests, and serialise the gh-pages deploy - #5

Merged
tannevaled merged 1 commit into
mainfrom
ci/build-on-pull-requests
Aug 26, 2026
Merged

tannevaled merged 1 commit into
mainfrom
ci/build-on-pull-requests

Conversation

@tannevaled

Copy link
Copy Markdown
Contributor

This workflow ran only on main, so a dependency bump here has no signal at all: three Renovate pull requests are open against this repository and not one of them has a single check. Nothing can say whether they are safe to merge, and merging them blind is how a broken toolchain lands.

The change

  • Build on pull_request as well as on main.
  • deploy is unchanged except that it now needs: build and runs only for push or workflow_dispatch — a pull request has no business pushing to gh-pages, and a fork's PR is not granted contents: write anyway.
  • deploy gets a concurrency group. Two mike deploy --push runs at once end with ! [rejected] gh-pages -> gh-pages (fetch first); cancel-in-progress stays false deliberately, since killing a publish half way through is worse than making it wait.

Verified before pushing

mkdocs build --strict exits 0 against this tree in a python:3.12-slim container, so the new job lands green rather than immediately red. actionlint reports nothing on the file.

The Python and setup-python versions are left exactly as they are — the open Renovate PRs propose those bumps, and once this lands they can be judged on their own checks instead of merged blind.

How this was found

A sweep for open dependency PRs with no checks at all. Most turned out to be PRs whose lane simply predated its pull_request trigger and only needed gh pr update-branch; this repository is one of the few where the trigger genuinely does not exist.

This workflow ran only on main, so a dependency bump here had no signal at
all: three Renovate pull requests are open against this repository and not
one of them has a single check. Nothing can say whether they are safe to
merge, and merging them blind is how a broken toolchain lands.

Build on pull_request as well. The deploy job is unchanged except that it
now waits on the build and runs only for push or workflow_dispatch -- a
pull request has no business pushing to gh-pages, and a fork's PR is not
granted `contents: write` anyway.

The deploy also gets a concurrency group. Two `mike deploy --push` runs at
once end with

    ! [rejected]  gh-pages -> gh-pages (fetch first)

and cancel-in-progress stays false deliberately: killing a publish half way
through is worse than making it wait, and the queued run then fetches the
gh-pages the previous one just wrote.

Verified before pushing: `mkdocs build --strict` exits 0 against this tree
in a python:3.12-slim container, so the new job lands green rather than red.
The Python and setup-python versions are left exactly as they are -- the
open Renovate PRs propose those, and they can now be judged on their own
checks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@tannevaled
tannevaled merged commit 8afecb2 into main Aug 26, 2026
2 checks passed
@tannevaled
tannevaled deleted the ci/build-on-pull-requests branch August 26, 2026 13:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant