Feat/notion renderer

.env.example

@@ -0,0 +1,11 @@
+# The site needs no credentials, and neither does reading Notion.
+#
+# Content is fetched from Notion's public API by scripts/fetch-notion.mjs and
+# committed to the repo; the build and the served site never talk to Notion.
+#
+# Uploading videos to the DigitalOcean Space happens in CI only, using the
+# repository secrets DO_SPACES_KEY and DO_SPACES_SECRET. To run the upload by
+# hand (scripts/sync-media.sh), export those two in your shell.
+#
+# NOTION_API_SECRET is only used by scripts/notion_export.py, which is kept as
+# reference material and is not part of the build.

.github/workflows/deploy-docs.yml

@@ -1,63 +1,81 @@
 name: deploy-docs
 
+# Builds the static site and publishes it to the gh-pages branch, which is what
+# GitHub Pages serves at docs.giveth.io.
+#
+# The build reads content/ from the repo and never contacts Notion. Refreshing
+# that content is refresh-content.yml's job; a push it makes lands here.
+
 on:
-  pull_request:
-    branches: [master]
   push:
     branches: [master]
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-docs
+  cancel-in-progress: false
 
 jobs:
-  checks:
-    if: github.event_name != 'push'
+  build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-node@v1
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
         with:
-          node-version: ">=16.14"
-      - name: Test Build
-        run: |
-          if [ -e yarn.lock ]; then
-          yarn install --frozen-lockfile
-          elif [ -e package-lock.json ]; then
-          npm ci
-          else
-          npm i
-          fi
-          npm run build
-  gh-release:
+          node-version: '20'
+          cache: npm
+
+      - run: npm ci
+
+      - name: Build static site
+        run: npm run build
+
+      - name: Check every live URL was generated
+        run: node scripts/check-export.mjs
+
+      - name: Check hosted videos and files are reachable
+        # Warns rather than fails: a missing video should not hold back a text
+        # fix. refresh-content is where a missing upload actually blocks.
+        if: github.event_name != 'pull_request'
+        run: scripts/sync-media.sh --verify || echo "::warning::Some hosted files are not on the Space. Run refresh-content."
+
+      - name: Upload build
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@v4
+        with:
+          name: site
+          path: out
+          retention-days: 3
+
+  publish:
+    needs: build
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-node@v1
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
         with:
-          node-version: ">=16.14"
-      - name: Add key to allow access to repository
-        env:
-          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-        run: |
-          mkdir -p ~/.ssh
-          ssh-keyscan github.com >> ~/.ssh/known_hosts
-          echo "${{ secrets.GH_PAGES_DEPLOY }}" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          cat <<EOT >> ~/.ssh/config
-          Host github.com
-          HostName github.com
-          IdentityFile ~/.ssh/id_rsa
-          EOT
-      - name: Release to GitHub Pages
+          name: site
+          path: out
+
+      - name: Publish to gh-pages
         env:
-          USE_SSH: true
-          GIT_USER: git
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          git config --global user.email "actions@gihub.com"
-          git config --global user.name "gh-actions"
-          if [ -e yarn.lock ]; then
-          yarn install --frozen-lockfile
-          elif [ -e package-lock.json ]; then
-          npm ci
-          else
-          npm i
-          fi
-          npx docusaurus deploy
+          set -euo pipefail
+          cd out
+          touch .nojekyll
+          git init -q
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git commit -q -m "Deploy ${GITHUB_SHA::7}"
+          git push -q --force \
+            "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
+            HEAD:gh-pages

.github/workflows/refresh-content.yml

@@ -0,0 +1,79 @@
+name: refresh-content
+
+# Pulls the latest content out of Notion and commits it. Pushing to master
+# triggers deploy-docs, so a Notion edit reaches the site without anyone
+# running anything locally.
+#
+# Runs on a schedule, and can be triggered immediately:
+#
+#   - by hand, from the Actions tab ("Run workflow")
+#   - by a Notion automation or any webhook, with a repository_dispatch:
+#
+#       curl -X POST https://api.github.com/repos/Giveth/giveth-docs/dispatches \
+#         -H "Accept: application/vnd.github+json" \
+#         -H "Authorization: Bearer <token with contents:write>" \
+#         -d '{"event_type":"notion-updated"}'
+
+on:
+  schedule:
+    # Every three hours. Notion edits appear within that window on their own.
+    - cron: '0 */3 * * *'
+  workflow_dispatch:
+  repository_dispatch:
+    types: [notion-updated]
+
+concurrency:
+  group: refresh-content
+  cancel-in-progress: false
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+
+      - run: npm ci
+
+      - name: Fetch from Notion
+        # The script refuses to write a suspiciously small tree, and leaves the
+        # committed content untouched if it cannot read Notion at all. A failed
+        # asset download is reported but should not block a content update.
+        run: npm run fetch-notion || echo "FETCH_WARNINGS=1" >> "$GITHUB_ENV"
+
+      - name: Upload new videos and files to the Space
+        # Runs in the same job as the fetch because the download URLs it uses
+        # expire within the hour. Failing here stops the commit below, so the
+        # site never references a file the Space does not have.
+        env:
+          DO_SPACES_KEY: ${{ secrets.DO_SPACES_KEY }}
+          DO_SPACES_SECRET: ${{ secrets.DO_SPACES_SECRET }}
+        run: scripts/sync-media.sh
+
+      - name: Verify the site still builds
+        run: npm run build && node scripts/check-export.mjs
+
+      - name: Commit any changes
+        run: |
+          set -euo pipefail
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add content public/notion-assets public/search-index.json
+          if git diff --cached --quiet; then
+            echo "Notion content unchanged."
+            exit 0
+          fi
+          git commit -q -m "Refresh content from Notion
+
+          Generated by .github/workflows/refresh-content.yml."
+          git push
+
+      - name: Warn about assets that could not be fetched
+        if: env.FETCH_WARNINGS == '1'
+        run: echo "::warning::Some Notion assets could not be downloaded. See the fetch step log."

.gitignore

@@ -18,3 +18,21 @@
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+
+# Local secrets
+.env
+
+# Next.js
+/.next
+/out
+next-env.d.ts
+*.tsbuildinfo
+
+# Legacy Docusaurus tree, staged for deletion
+/.legacy-docusaurus
+
+# Static export output
+/out
+
+# Transient build state (signed URLs that expire within the hour)
+/.cache

.probe.mjs

@@ -0,0 +1,14 @@
+import { readFile } from 'node:fs/promises'
+const sm = JSON.parse(await readFile('content/site-map.json','utf8'))
+const pid = sm.slugToPage['/recurringdonation'].pageId
+const rm = JSON.parse(await readFile(`content/pages/${pid}.json`,'utf8'))
+const map = rm.recordMap ?? rm
+console.log('signed_urls entries:', Object.keys(map.signed_urls||{}).length)
+for (const [k,v] of Object.entries(map.signed_urls||{})) {
+  console.log('\n key:', k.slice(0,110))
+  console.log(' val:', String(v).slice(0,110))
+  try {
+    const r = await fetch(v, { method:'GET', headers:{range:'bytes=0-1023'} })
+    console.log(' fetch:', r.status, r.headers.get('content-type'), r.headers.get('content-length'))
+  } catch(e){ console.log(' fetch ERR', e.message) }
+}