The publish job installed cloudron-surfer 6.4.1 and uploaded with a token; the
current major takes a Cloudron username plus an app password instead. Pin
@cloudron/surfer 7.2.0, user allan, password from SURFER_PASSWORD.
`deploy` rather than `put`: it swaps the site atomically, so a failed upload
leaves the current site serving, and it records the ref and commit in the site's
deploy history. The docs are a named site (`docs`) on its own alias domain, so
both are passed.
Also adds workflow_dispatch, so a deploy can be run by hand.
The publish workflow installed cloudron-surfer, the mkdocs pip set and
@marp-team/marp-cli with no version pins, so a breaking or compromised upstream
release would ship straight to the live site on the next merge to main.
- pin cloudron-surfer@6.4.1, mkdocs==1.6.1, mkdocs-material==9.7.7,
fontawesome_markdown==0.2.6, mkdocs-redirects==1.2.3 and
@marp-team/marp-cli@4.5.1 (the versions the site builds with today)
- add .npmrc with ignore-scripts=true and save-exact=true; neither npm package
ships an install/preinstall/postinstall hook, so nothing is skipped
dc
allan