Repository navigation
feat: build.script + build.aptPackages for pre-upload transform - #3
Conversation
The Mint OIDC token step calls the runner-local token broker
($ACTIONS_ID_TOKEN_REQUEST_URL) and exchanges the broker token
for a short-lived ID token scoped to the configured audience.
Failures are non-fatal: if OIDC env vars aren't present (e.g.
caller forgot 'permissions: id-token: write'), we fall back to
the static PROJECT_EMBED_UPLOAD_TOKEN bearer.
The Upload step now picks BEARER from OIDC if available, else
static bearer, else fails with explicit guidance.
Caller workflows must include in their permissions block:
permissions:
contents: write
pull-requests: write
id-token: write
Static bearer remains supported for repos that don't (or can't)
use OIDC, e.g. manual upload scripts.
Two new steps insert between manifest read and source staging: 1. **Install apt packages** — reads `build.aptPackages` from the manifest and runs `apt-get install -y`. Lets manifests declare non-default tools (ffmpeg, emscripten, cmake, etc.) without requiring caller workflows to pre-install them. 2. **Run build.script** — if the manifest declares `build.script`, chmod +x and execute it from the repo root. The script gets `EMBED_SLUG`, `EMBED_VERSION`, `EMBED_SOURCE_DIR` env vars. It's expected to write its outputs into `source-dir` so the subsequent stage step picks them up. Use cases: - Optimize textures: `ffmpeg` re-encode of large MP4s before upload - Compile WASM: `emcc src/foo.cpp -o assets/foo.html` for C++ → web - Convert notebooks: `jupyter nbconvert --to html` - TypeScript builds, Cargo wasm-pack, etc. Both steps are no-ops when the manifest fields are absent, so existing repos stay back-compat.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 77ac488e4d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| contents: write | ||
| pull-requests: write | ||
| # Mint OIDC tokens. Required for the OIDC auth path. | ||
| id-token: write |
There was a problem hiding this comment.
Existing callers that follow this repo's documented reusable-workflow job permissions grant only contents: write and pull-requests: write; in GitHub's reusable-workflow permission model, the called workflow can only downgrade the caller job's token, so adding id-token: write here exceeds the caller's allowed permissions instead of merely making OIDC optional. Those runs fail before reaching the new fallback logic, so repos still using PROJECT_EMBED_UPLOAD_TOKEN are broken unless every caller is updated to include id-token: write.
Useful? React with 👍 / 👎.
Companion to baladithyab/baladithyab.github.io#38. Adds two optional pre-upload steps to the reusable workflow.
What it does
Reads
build.aptPackagesandbuild.scriptfromweb.codeseys.json. IfaptPackagesis set, installs them. Ifscriptis set, runs it.Why
The architecture currently assumes upload-ready files are committed to the source repo. This forces inefficient choices:
With build-step support, manifests can declare 'how to make these files', and CI does it.
Example manifest
{ "build": { "ci": true, "workflow": ".github/workflows/build-web-asset.yml", "aptPackages": ["ffmpeg"], "script": "scripts/optimize-textures.sh" } }Back-compat
Both fields are optional; manifests without them skip the steps entirely. All 3 existing repos keep working unchanged.
🤖 Generated with the help of Claude