Shared memory and context tools for agentic work.
Code Rooms
name: Deploy m1nd Site to GitHub Pages
on:
workflow_dispatch:
push:
branches:
- main
paths:
- "docs/**"
- "m1nd-demo/**"
- ".github/workflows/deploy-wiki.yml"
permissions:
contents: read
concurrency:
group: pages
cancel-in-progress: false
jobs:
build:
name: Read-only Pages build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
with:
persist-credentials: false
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
node-version: "22"
cache: npm
cache-dependency-path: m1nd-demo/package-lock.json
- name: Build the locked landing in an unprivileged job
working-directory: m1nd-demo
run: |
npm ci
npm run build
# Supply chain PROVEN 2026-07-30: the three Pages actions below are pinned to
# the immutable commit SHAs of their latest releases, resolved through the
# GitHub API (releases/latest -> git tag object -> commit):
# actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d (v6.0.0)
# actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 (v5.0.0)
# actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 (v5.0.0)
# The wiki is NOT version-controlled pre-built (book.toml emits ../../wiki-build,
# which is ignored), so CI builds it with the same mdbook toolchain the book was
# authored against: release binaries pinned by version AND sha256, verified before
# extraction. Everything runs in this unprivileged job; the privileged deploy
# below still checks nothing out and runs no scripts.
- name: Install the pinned mdbook toolchain (checksum-verified)
set -euo pipefail
curl -sSL -o mdbook.tar.gz https://github.com/rust-lang/mdBook/releases/download/v0.5.0/mdbook-v0.5.0-x86_64-unknown-linux-gnu.tar.gz
echo "4a00aa3fc44cee2721efb7b9b7b599877f28360967f8dfaa61ee2990f2736f77 mdbook.tar.gz" | sha256sum -c -
curl -sSL -o mdbook-mermaid.tar.gz https://github.com/badboy/mdbook-mermaid/releases/download/v0.17.0/mdbook-mermaid-v0.17.0-x86_64-unknown-linux-gnu.tar.gz
echo "8aced70d781830fb0e81988f081c4abdd49e056a001ae2f1e4d484e1f6385c57 mdbook-mermaid.tar.gz" | sha256sum -c -
mkdir -p "$HOME/.local/bin"
tar -xzf mdbook.tar.gz -C "$HOME/.local/bin" mdbook
tar -xzf mdbook-mermaid.tar.gz -C "$HOME/.local/bin" mdbook-mermaid
rm mdbook.tar.gz mdbook-mermaid.tar.gz
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
- name: Build the wiki
run: mdbook build docs/wiki
- name: Assemble the Pages artifact (site + wiki)
mkdir -p _site
cp -R m1nd-demo/dist/. _site/
cp -R wiki-build _site/wiki
- uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
- uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
path: _site
deploy:
name: Privileged Pages deploy (pinned, no checkout)
needs: build
pages: write
id-token: write
environment:
name: github-pages
# No checkout, package install, or repository script runs in this job: the
# only step is the pinned deploy action consuming the artifact from build.
- uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
