Signed-off-by: Kingdon Barrett <kingdon@weave.works>

* test build and push
* test again
* pull the result of build

This is not for merge, it is just for the example

* actions/cache@v3

* this is too much indirection

but it's for testing so I think it's OK
(the original idea was to pull this at runtime, so we'd always have the
latest – this is going to need some refining, but I just want something
that I can run right now, and say the job is done, point a domain at it,
and call it good for today)

push server

* slightly broken ingress manifests

works:
http://teamhephy.info/
http://docs.teamhephy.info/
http://teamhephy.info/workflow/docs/
http://docs.teamhephy.info/workflow/docs/

doesn't (bad):
http://docs.teamhephy.info/workflow/docs
http://teamhephy.info/workflow/docs

enable production letsencrypt

try a new text
trigger another build

try imagePullPolicy: Always

try another build

try one more
tracking one behind

Add keyless (experimental) signing with Cosign

This may or may not work? Just try it...

Signed-off-by: Kingdon Barrett <kingdon@weave.works>

add differentiation between "build" and "serve"

we're going to remove this again in a moment, but it will be helpful to
have the tasks separated before we try to obviate them together again

set up flux-pull.sh for exec at runtime

update deployment manifest and add init container

soften rsync -a

rsync: [generator] chgrp "/usr/share/nginx/html/." failed: Operation not permitted (1)

a side effect of the -g in -rlptgoD, (how -a is expanded)

further soften -t

rsync: [generator] failed to set times on "/usr/share/nginx/html/.": Operation not permitted (1)

further soften -p

rsync: [generator] failed to set permissions on "/usr/share/nginx/html/.": Operation not permitted (1)

USER 101 directive messes a bunch of things up

nginx will drop the root user permission, so long as we are root when we
start running (but with this USER directive here, it won't even start)

Signed-off-by: Kingdon Barrett <kingdon@weave.works>

try rebuilding docs

add write packages permission here

skip the pre-build part

try again with fresh docs

all of this chown stuff is unnecessary

the server drops permissions, but the container starts as root

let's test tagging docs

not sure if these really worked

try for beta2
try later metadata-action version
remove redundant USER root

make sure to tag the artifact as "testing" too

this is our environment tag (until we come up with something better!)

beta3

Signed-off-by: Kingdon Barrett <kingdon@weave.works>

Signed-off-by: Kingdon Barrett <kingdon@weave.works>

Signed-off-by: Kingdon Barrett <kingdon@weave.works>

try fixup cosign

* only build main when Dockerfile changes

we don't need a new `serve` image unless one of these files has changed

try fixup action
puts debugger

* ahhhh

it is working

cosign OCI manifests which are addressed by digest are signed without
warning

Signed-off-by: Kingdon Barrett <kingdon@weave.works>

Signed-off-by: Kingdon Barrett <kingdon@weave.works>