feat: P0588R1で追加されたodr-usableについて記述

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    # Workflow files stored in the
+    # default location of `.github/workflows`
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 20

.github/workflows/build.yml

@@ -2,6 +2,13 @@ name: build
 
 on:
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      arguments:
+        description: "build.sh に渡すコマンドライン引数"
+        default: ''
+        required: false
+        type: string
   push:
     branches:
       - master
@@ -12,53 +19,152 @@ on:
 
 jobs:
   build:
+    if: github.repository_owner == 'cpprefjp' || startsWith(inputs.arguments, '--pull ')
     runs-on: ubuntu-latest
     steps:
-    - name: Register SSH key
-      env:
-        CPPREFJP_GITHUB_IO_SECRETS: ${{ secrets.CPPREFJP_GITHUB_IO_SECRETS }}
+    - id: vars
       run: |
-        mkdir -p $HOME/.ssh
-        echo "$CPPREFJP_GITHUB_IO_SECRETS" > $HOME/.ssh/id_ed25519
-        chmod 600 $HOME/.ssh/id_ed25519
+        echo "base_repo=${{ startsWith(inputs.arguments, '--pull ') && github.event.pull_request.base.repo.full_name || github.event.repository.full_name }}" >> "$GITHUB_OUTPUT"
+        echo "head_repo=${{ startsWith(inputs.arguments, '--pull ') && github.event.pull_request.head.repo.full_name || github.event.repository.full_name }}" >> "$GITHUB_OUTPUT"
+        echo "head_ref=${{ startsWith(inputs.arguments, '--pull ') && github.event.pull_request.head.ref || github.ref }}" >> "$GITHUB_OUTPUT"
 
     # site_generator
-    - uses: actions/checkout@v2
+    - name: Check out cpprefjp/site_generator
+      uses: actions/checkout@v7
       with:
         repository: cpprefjp/site_generator
         path: site_generator
-    - run: git submodule update -i
+    - run: git submodule update --init
       working-directory: site_generator
 
     # kunai
-    - uses: actions/checkout@v2
+    - name: Check out cpprefjp/kunai
+      uses: actions/checkout@v7
       with:
         repository: cpprefjp/kunai
         path: site_generator/kunai
-    - run: git submodule update -i
+    - run: git submodule update --init
       working-directory: site_generator/kunai
 
-    # cpprefjp.github.io
-    - uses: actions/checkout@v2
-      with:
-        repository: cpprefjp/cpprefjp.github.io
-        path: site_generator/cpprefjp/cpprefjp.github.io
-
-    # site
-    - uses: actions/checkout@v2
+    # site (typically cpprefjp/site)
+    - name: Check out ${{ steps.vars.outputs.head_repo }}
+      uses: actions/checkout@v7
       with:
-        repository: cpprefjp/site
-        path: site_generator/cpprefjp/site
+        repository: ${{ steps.vars.outputs.head_repo }}
         # atom 生成のために全履歴が必要
         fetch-depth: 0
-    - run: git submodule update -i
+        ref: ${{ steps.vars.outputs.head_ref }}
+        path: site_generator/cpprefjp/site
+        allow-unsafe-pr-checkout: true
+    - run: git submodule update --init
       working-directory: site_generator/cpprefjp/site
 
+    # image
+    - name: Check out cpprefjp/image
+      uses: actions/checkout@v7
+      with:
+        repository: cpprefjp/image
+        path: site_generator/cpprefjp/image
+
     - name: Set up Python 3.x
-      uses: actions/setup-python@v1
+      uses: actions/setup-python@v7
+      with:
+        python-version: 3.11
+        # 3.12でUndefined symbolエラーがでた
+
+    # build.sh - base の build.sh を使う必要がある。もし PR head の
+    # build.sh を使うと、pull_request_target で呼び出された時に PR
+    # head の build.sh に悪意のあるコードが埋め込まれていると秘密鍵な
+    # ど盗まれてしまう。
+    - name: Check out build.sh
+      uses: actions/checkout@v7
+      with:
+        repository: ${{ steps.vars.outputs.base_repo }}
+        ref: master
+        sparse-checkout: .github
+        path: .trusted
+
+    # Deploy 用
+    - name: "(Deploy) Register SSH key"
+      if: inputs.arguments == ''
+      env:
+        CPPREFJP_GITHUB_IO_SECRETS: ${{ secrets.CPPREFJP_GITHUB_IO_SECRETS }}
+      run: |
+        mkdir -p $HOME/.ssh
+        echo "$CPPREFJP_GITHUB_IO_SECRETS" > $HOME/.ssh/id_ed25519
+        chmod 600 $HOME/.ssh/id_ed25519
+
+    # Deploy 用
+    - name: "(Deploy) Check out cpprefjp.github.io"
+      if: inputs.arguments == ''
+      uses: actions/checkout@v7
+      with:
+        repository: cpprefjp/cpprefjp.github.io
+        path: site_generator/cpprefjp/cpprefjp.github.io
+
+    # Preview 用
+    - name: "(Preview build) Check out gh-pages"
+      if: startsWith(inputs.arguments, '--pull ')
+      continue-on-error: true
+      uses: actions/checkout@v7
+      with:
+        repository: ${{ github.event.pull_request.base.repo.full_name }}
+        ref: gh-pages
+        path: site_generator/cpprefjp/gh-pages
+    - name: "(Preview build) Collect GitHub context"
+      id: preview_vars
+      if: startsWith(inputs.arguments, '--pull ')
+      uses: actions/github-script@v9
       with:
-        python-version: 3.x
+        script: |
+          const sha0 = context.payload.pull_request.base.sha;
+          const sha = context.payload.pull_request.head.sha;
+          const base_url = (() => {
+            const owner = context.payload.pull_request.base.repo.owner.login;
+            const repo = context.payload.pull_request.base.repo.name;
+            const pull = context.payload.number;
+            return `https://${owner}.github.io/${repo}/gen/pull/${pull}`;
+          })();
+          const repo_full = context.payload.pull_request.base.repo.full_name;
+          const branch = context.payload.pull_request.head.ref;
+
+          core.setOutput('sha0', sha0);
+          core.setOutput('sha', sha);
+          core.setOutput('base_url', base_url);
+          core.setOutput('repo_full', repo_full);
+          core.setOutput('ubranch', encodeURIComponent(branch));
 
     # あとはスクリプトで頑張る
-    - run: ./cpprefjp/site/.github/workflows/script/build.sh
+    - name: Run script build.sh
+      run: ../.trusted/.github/workflows/script/build.sh ${{ inputs.arguments }}
+      env:
+        base_git_url: ${{ github.event.pull_request.base.repo.clone_url }}
+        base_git_ref: ${{ github.event.pull_request.base.ref }}
+        commit_base: ${{ steps.preview_vars.outputs.sha0 }}
+        commit_head: ${{ steps.preview_vars.outputs.sha }}
+        preview_base_url: ${{ steps.preview_vars.outputs.base_url }}
+        preview_repo_url: https://github.com/${{ steps.preview_vars.outputs.repo_full }}
+        preview_ubranch: ${{ steps.preview_vars.outputs.ubranch }}
       working-directory: site_generator
+
+    # Preview 用
+    - name: "(Preview build) Publish result in gh-pages"
+      if: startsWith(inputs.arguments, '--pull ')
+      uses: peaceiris/actions-gh-pages@v4
+      with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        publish_dir: ./site_generator/cpprefjp/gh-pages
+        user_name: 'github-actions[bot]'
+        user_email: '41898282+github-actions[bot]@users.noreply.github.com'
+
+        # Note: 以下のコミットメッセージは .github/workflows/preview_clear.yml
+        # で削除対象のコミットの特定に用いるので、変更する場合は preview_clear
+        # も一緒に更新すること。
+        commit_message: |
+          Preview PR ${{ github.event.number }}: ${{ github.event.pull_request.head.sha }} ←
+
+        enable_jekyll: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true