···

       
2
       
 
       
image:

     

       
3
       
 
       
  name: "$CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX/nixos/nix:latest"

     

       
4
       
 
       
  entrypoint:

     

       
5
       
-
       
    - /root/.nix-profile/bin/bash

     

       
6
       
 
       
stages:

     

       
7
       
 
       
  - test

     

       
8
       
 
       
  - build

     
···

       
24
       
 
       
  #FF_GIT_COMMITTERS_API: "true"

     

       
25
       
 
       
  SECURE_FILES_DOWNLOAD_PATH: .secretskit

     

       
26
       
 
       
  GIT_DEPTH: "0"

     

       
0
       
 
       

     

       
0
       
 
       

     

       
27
       
 
       
  # dotenvx stuff

     

       
28
       
 
       
  DOTENV_PRIVATE_KEY: $DOTENV_PRIVATE_KEY_CI

     

       
29
       
 
       
  MKDOCS_GIT_COMMITTERS_PLUGIN_TOKEN: $CI_JOB_TOKEN

     

···

       
2
       
 
       
image:

     

       
3
       
 
       
  name: "$CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX/nixos/nix:latest"

     

       
4
       
 
       
  entrypoint:

     

       
5
       
+
       
    - /nix/store/smkzrg2vvp3lng3hq7v9svfni5mnqjh2-bash-interactive-5.2p37/bin/bash

     

       
6
       
 
       
stages:

     

       
7
       
 
       
  - test

     

       
8
       
 
       
  - build

     
···

       
24
       
 
       
  #FF_GIT_COMMITTERS_API: "true"

     

       
25
       
 
       
  SECURE_FILES_DOWNLOAD_PATH: .secretskit

     

       
26
       
 
       
  GIT_DEPTH: "0"

     

       
27
       
+
       
  # ignore pipfile and rely on the lockfile for deterministic builds

     

       
28
       
+
       
  PIPENV_IGNORE_PIPFILE: "true"

     

       
29
       
 
       
  # dotenvx stuff

     

       
30
       
 
       
  DOTENV_PRIVATE_KEY: $DOTENV_PRIVATE_KEY_CI

     

       
31
       
 
       
  MKDOCS_GIT_COMMITTERS_PLUGIN_TOKEN: $CI_JOB_TOKEN

     

···

       
8
       
 
       
engine: nixery

     

       
9
       
 
       


     

       
10
       
 
       
clone:

     

       
11
       
-
       
  depth: 0

     

       
12
       
 
       
  submodules: true

     

       
13
       
 
       


     

       
14
       
 
       
# sync this with devenv.nix + devenv.yaml (if applicable for additional flakes

     
···

       
39
       
 
       
steps:

     

       
40
       
 
       
  - name: Install deps

     

       
41
       
 
       
    command: |

     

       
42
       
-
       
      pipenv install

     

       
43
       
 
       
      npm ci

     

       
44
       
 
       
    environment:

     

       
45
       
 
       
      PIPENV_IGNORE_PIPFILE: "true"

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
46
       
 
       
  - name: Deploy to Cloudflare Workers (as Static Site)

     

       
47
       
 
       
    command: doppler run -- npm run deploy:cf
     

···

       
8
       
 
       
engine: nixery

     

       
9
       
 
       


     

       
10
       
 
       
clone:

     

       
11
       
+
       
  depth: 500

     

       
12
       
 
       
  submodules: true

     

       
13
       
 
       


     

       
14
       
 
       
# sync this with devenv.nix + devenv.yaml (if applicable for additional flakes

     
···

       
39
       
 
       
steps:

     

       
40
       
 
       
  - name: Install deps

     

       
41
       
 
       
    command: |

     

       
42
       
+
       
      pipenv install --deploy --ignore-pipfile

     

       
43
       
 
       
      npm ci

     

       
44
       
 
       
    environment:

     

       
45
       
 
       
      PIPENV_IGNORE_PIPFILE: "true"

     

       
46
       
+
       
  # We configured our wrangler.toml to use our build script (at ../../bin/build.sh)

     

       
47
       
+
       
  # for building the site and doing post-build prep (like copying well-known files

     

       
48
       
+
       
  # and such). To minimize admin overhead on secrets management, we use `doppler run`

     

       
49
       
+
       
  # to inject secrets from Doppler into the environment for the build and deploy steps.

     

       
50
       
 
       
  - name: Deploy to Cloudflare Workers (as Static Site)

     

       
51
       
 
       
    command: doppler run -- npm run deploy:cf
     

···

       
4
       
 
       
TARGET_DIR="${PWD}/public"

     

       
5
       
 
       
pipenv run build

     

       
6
       
 
       
cp "$TARGET_DIR/assets/images/favicon.png" "$TARGET_DIR/favicon.ico" -v

     

       
7
       
-
       
#cp "$SOURCE_DIR/.well-known" "$TARGET_DIR/" -rv

     

···

       
4
       
 
       
TARGET_DIR="${PWD}/public"

     

       
5
       
 
       
pipenv run build

     

       
6
       
 
       
cp "$TARGET_DIR/assets/images/favicon.png" "$TARGET_DIR/favicon.ico" -v

     

       
7
       
+
       
cp "$SOURCE_DIR/.well-known" "$TARGET_DIR/" -rv