feat: mlbundle 0.2.0 with websites and automatic publishing

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ on:
     branches: [main, develop]
   pull_request:
     branches: [main, develop]
+  workflow_dispatch:
   workflow_call:
     inputs:
       prepare-publish:
@@ -16,6 +17,23 @@ permissions:
   contents: read
 
 jobs:
+  sites:
+    name: Frontend checks
+    uses: ./.github/workflows/sites.yml
+
+  deploy-sites:
+    name: Deploy websites
+    needs: [build, base-install, lint, types, tests, sites]
+    if: >-
+      github.repository == 'UlloaSP/mlbundle' &&
+      github.ref == 'refs/heads/main' &&
+      !inputs.prepare-publish &&
+      (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    uses: ./.github/workflows/deploy-sites.yml
+    secrets:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+
   build:
     name: Build distributions
     runs-on: ubuntu-latest

.github/workflows/deploy-sites.yml

@@ -0,0 +1,71 @@
+name: Deploy websites
+
+on:
+  workflow_call:
+    secrets:
+      CLOUDFLARE_API_TOKEN:
+        required: true
+      CLOUDFLARE_ACCOUNT_ID:
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    name: Deploy ${{ matrix.site }}
+    if: github.repository == 'UlloaSP/mlbundle' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - site: landing
+            url: https://mlbundle.eshkra.dev
+            title: MLbundle
+          - site: docs
+            url: https://docs.mlbundle.eshkra.dev
+            title: mlbundle documentation
+          - site: playground
+            url: https://playground.mlbundle.eshkra.dev
+            title: MLbundle Playground
+    environment:
+      name: ${{ matrix.site }}
+      url: ${{ matrix.url }}
+    concurrency:
+      group: mlbundle-${{ matrix.site }}-production
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1.21.2
+        with:
+          node-version: '24.14.1'
+          cache: true
+
+      - name: Install locked deployment tooling
+        run: vp install --frozen-lockfile
+
+      - name: Download tested site
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ matrix.site }}-build
+          path: ${{ matrix.site }}/dist/
+
+      - name: Deploy static assets and custom domain
+        run: vp exec wrangler deploy --config "$SITE/wrangler.jsonc"
+        env:
+          SITE: ${{ matrix.site }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+
+      - name: Check the deployed homepage
+        env:
+          SITE_URL: ${{ matrix.url }}
+          EXPECTED_TITLE: ${{ matrix.title }}
+        run: |
+          curl --fail --silent --show-error --location --retry 10 --retry-delay 15 \
+            --retry-all-errors --max-time 20 "$SITE_URL/" -o "$RUNNER_TEMP/site.html"
+          grep -Fq "<title>$EXPECTED_TITLE" "$RUNNER_TEMP/site.html"

.github/workflows/publish.yml

@@ -1,7 +1,9 @@
 name: Publish to PyPI
 
 on:
-  workflow_dispatch:
+  push:
+    branches: [main]
+    paths: [pyproject.toml]
 
 permissions:
   contents: read
@@ -11,26 +13,45 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  preflight:
+    name: Check version change
+    runs-on: ubuntu-latest
+    outputs:
+      publish: ${{ steps.check.outputs.publish }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check version change and PyPI availability
+        id: check
+        env:
+          PREVIOUS_REF: ${{ github.event.before }}
+        run: python scripts/publish_check.py --previous-ref "$PREVIOUS_REF"
+
   build:
+    needs: preflight
+    if: needs.preflight.outputs.publish == 'true'
     uses: ./.github/workflows/ci.yml
     with:
       prepare-publish: true
 
   publish:
-    needs: build
+    needs: [preflight, build]
+    if: needs.preflight.outputs.publish == 'true' && needs.build.result == 'success'
     runs-on: ubuntu-latest
     environment:
       name: pypi_env
       url: https://pypi.org/p/mlbundle
-    permissions:
-      id-token: write
     steps:
       - name: Download CI-validated distributions
         uses: actions/download-artifact@v4
         with:
           name: distributions
           path: dist
-      - name: Publish to PyPI with Trusted Publishing
+      - name: Publish to PyPI with the project token
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: dist/
+          user: __token__
+          password: ${{ secrets.MLBUNDLE_API_TOKEN }}

.github/workflows/sites.yml

@@ -0,0 +1,77 @@
+name: Check and build websites
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  check-build:
+    name: Frontend lint, types, tests and builds
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1.21.2
+        with:
+          node-version: '24.14.1'
+          cache: true
+
+      - name: Install locked dependencies
+        run: vp install --frozen-lockfile
+
+      - name: Check lint, Astro formatting, types and unit tests
+        run: vp run check
+
+      - name: Test the Python browser runtime and all examples
+        run: vp run mlbundle-playground#test:runtime
+
+      - name: Build all three sites
+        run: vp run build
+
+      - name: Validate Cloudflare deployment configuration
+        run: vp run check:deploy
+
+      - name: Install Chromium
+        working-directory: playground
+        run: vp exec playwright install --with-deps chromium
+
+      - name: Test the built playground on desktop and mobile
+        run: vp run mlbundle-playground#test:e2e:built
+
+      - name: Keep browser failure evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playground-test-results
+          path: playground/test-results/
+          if-no-files-found: ignore
+          retention-days: 7
+
+      # Only tested builds become deployable artifacts. Deployment never rebuilds them.
+      - name: Upload landing
+        uses: actions/upload-artifact@v4
+        with:
+          name: landing-build
+          path: landing/dist/
+          if-no-files-found: error
+          retention-days: 7
+
+      - name: Upload documentation
+        uses: actions/upload-artifact@v4
+        with:
+          name: docs-build
+          path: docs/dist/
+          if-no-files-found: error
+          retention-days: 7
+
+      - name: Upload playground
+        uses: actions/upload-artifact@v4
+        with:
+          name: playground-build
+          path: playground/dist/
+          if-no-files-found: error
+          retention-days: 7

.gitignore

@@ -16,6 +16,12 @@ __pycache__/
 .cache/
 .tox/
 .nox/
+node_modules/
+.astro/
+.vite/
+.wrangler/
+playwright-report/
+test-results/
 
 # Build output
 build/

.pre-commit-config.yaml

@@ -5,8 +5,10 @@ repos:
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-yaml
+        exclude: ^pnpm-lock\.yaml$
       - id: check-toml
       - id: check-added-large-files
+        exclude: ^brand/mlbundle\.png$
       - id: check-merge-conflict
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
@@ -20,3 +22,4 @@ repos:
     rev: v1.1.414
     hooks:
       - id: pyright
+        files: ^src/