chore(eddy): fix code-review findings — workflow split, et al. trunca… #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build LaTeX PDF | |
| on: | |
| # Build on every PR so the required status check always reports, even when | |
| # a PR touches only governance files (README, SECURITY.md, dependabot.yml). | |
| # Build is ~1m30s; cheap enough to run as a universal merge gate. | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'paper/**' | |
| - '.github/workflows/build-pdf.yml' | |
| pull_request: | |
| workflow_dispatch: | |
| # Workflow-level default is read-only; jobs opt-in to writes explicitly. | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| name: build | |
| runs-on: ubuntu-latest | |
| # Build/upload/attest do NOT need contents:write. The auto-commit lives in | |
| # a separate downstream job with its own narrowed write scope. | |
| permissions: | |
| contents: read | |
| attestations: write # SLSA build provenance | |
| id-token: write # OIDC signing for attestations | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Compile LaTeX | |
| uses: xu-cheng/latex-action@6549dc21effb2730855a1281407ecfcececc6c1b # v4.1.0 | |
| with: | |
| root_file: main.tex | |
| working_directory: paper | |
| - name: Upload PDF artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: eddy-paper | |
| path: paper/main.pdf | |
| if-no-files-found: error | |
| - name: Attest build provenance (SLSA) | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 | |
| with: | |
| subject-path: paper/main.pdf | |
| publish-pdf: | |
| name: publish-pdf | |
| needs: build | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| # contents:write scoped to this job alone — the only step that uses it | |
| # is the git commit/push at the bottom. | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Download built PDF | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: eddy-paper | |
| path: paper | |
| - name: Commit PDF | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add -f paper/main.pdf | |
| git diff --staged --quiet || git commit -m "Build PDF from LaTeX source" | |
| git push |