doll.systems
doll.systems community website for this one's writing forked from personhood.removal.surgery/doll.systems
Star
Fork
Watch
doll.systems docs CI.md
4.2 kB · 70 lines
Markdown
at main

ci and previews #

.tangled/workflows/check.yml runs lint, astro/typescript checks, tests and a static build on spindle for main pushes, pull requests targeting main and manual runs. it does not publish. the repo has one approved spindle secret, WISPCTL_APP_PASSWORD, for the preview and main Wisp workflows below.

pr previews on spindle #

.tangled/workflows/preview.yml builds branch-backed same-repository pull requests targeting main. Wisp's first-party preview mode (wispctl@2.0.3 --sha) publishes the build under pr-<sha7> and serves it at https://pr-<sha7>-doshi.preview.wisp.place/. each revision gets its own root origin, so root-relative assets and links need no rewriting. previews are marked X-Robots-Tag: noindex.

reference: https://docs.wisp.place/guides/preview-deploys/

this repo's spindle vault has one secret: WISPCTL_APP_PASSWORD, a new app password for doshi.doll.systems. the workflow reads it from the environment; it never puts it in a command argument or file in this repository. the Wisp claim doshi already belongs to that account. Spindle ran both check.yml and preview.yml successfully for the branch. https://pr-8f38b49-doshi.preview.wisp.place/ served the page, palette lab, stylesheet and font with HTTP 200; it sent X-Robots-Tag: noindex. Wisp says this preview feature is still pre-release, so this is an observed test rather than a stability promise.

this is a deliberate trust tradeoff: dōshi's account also owns the live doll.systems Wisp site and her personal site. the app password is not site-scoped; someone who can execute same-repo PR code with access to Spindle secrets could use it beyond previews. samhain reviewed and accepted that specific exposure. do not call this a preview-only credential or grant it to fork PRs. recovery is to remove the Spindle secret, revoke this particular app password and redeploy the pinned production release if necessary.

this PR was initially patch-only. spindle needs a real same-repo branch/commit, so doshi/ci-foundation was pushed and attached to the existing PR record; no direct commit to main. pr-<sha7> records accumulate until a separately reviewed expiry/cleanup policy is applied. a passing check is not a rendered preview: verify the root page, assets and content from this exact source SHA.

main to doll.systems #

.tangled/workflows/publish.yml is the actual production publisher proposed in this PR. it runs only on a push to main. it verifies the trigger, target Git repo DID and SHA, then runs locked install, lint, astro check, tests and build before touching Wisp. immediately before publishing it compares the pipeline SHA with the latest main ref on the knot and skips a stale run. it reads the existing WISPCTL_APP_PASSWORD secret from the environment and calls pinned wispctl@2.0.3 with --path dist --site doll-systems. no preview --sha mode and no secret in command arguments. doll.systems is already mapped to this site record; my personal home is separate. no DNS change.

this replaces the unused separate-publisher template. it has been reviewed locally but cannot be hosted-tested as a main-push publisher before merge. its first real release will happen when this PR is merged into main, with later reviewed main pushes using the same workflow. if it fails before publishing, the existing release remains; if it publishes bad content, disable the workflow and redeploy the saved pinned release at 5698b9bc51adaf8e5d4739f9a17fd3b3568aee43. rapid concurrent pushes could still race between the latest-ref check and the Wisp write; a future monotonic deploy guard would strengthen that edge.

evidence and remaining limits #

the branch-backed CI and one real PR preview are observed, with working assets and unchanged production. because this PR only edits CI/docs, its rendered page looks like current main; a separate visible-content PR can test that distinction. first hosted main publish, repeat previews, expiry/cleanup of old pr-<sha7> records and a bot comment/webhook are not yet established. a successful build alone is not a preview, and a locally parsed publisher is not a hosted release.