Connectome dashboard #50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Connectome dashboard | |
| # Regenerates the connectome import dashboard automatically: | |
| # - on push to main that touches the manifest, probes, or import code | |
| # - nightly, so upstream/PDB changes surface without anyone touching the repo | |
| # - on demand via the "Run workflow" button | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'dashboard/connectomes.yaml' | |
| - 'dashboard/probes.py' | |
| - 'dashboard/generate.py' | |
| - 'src/**' | |
| - '.github/workflows/dashboard.yml' | |
| schedule: | |
| - cron: '0 6 * * *' # 06:00 UTC daily | |
| workflow_dispatch: | |
| permissions: | |
| contents: read # generated files are never committed — Pages only | |
| pages: write # to publish the dashboard | |
| id-token: write | |
| concurrency: | |
| group: connectome-dashboard | |
| cancel-in-progress: false | |
| jobs: | |
| build-and-publish: | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deploy.outputs.page_url }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # The repo is public, so a committed .env cannot be un-leaked — it stays in | |
| # git history, forks and caches. Fail loudly rather than publish quietly. | |
| - name: Refuse to build if a secrets file was committed | |
| run: | | |
| if git ls-files --error-unmatch .env 2>/dev/null; then | |
| echo "::error::.env is tracked in git. Remove it (git rm --cached .env) and ROTATE the credentials." | |
| exit 1 | |
| fi | |
| echo "no tracked .env — ok" | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.10' | |
| - name: Install deps | |
| # Dashboard is stdlib-only apart from these two — never the src/ stack. | |
| run: pip install -r dashboard/requirements.txt | |
| - name: Generate dashboard | |
| env: | |
| # All optional. Any absent secret makes its probe degrade to "unknown" | |
| # rather than fail, so forks (which never receive secrets) still build. | |
| # | |
| # Enables the "needs update" upstream check for neuPrint. | |
| NEUPRINT_TOKEN: ${{ secrets.NEUPRINT_TOKEN }} | |
| # Enables KB probes ("authored in KB" vs "released in PDB"). The KB | |
| # wants HTTP Basic. Use a READ-ONLY account: probes.py refuses to send | |
| # write Cypher, but that guard should not be the only thing stopping it. | |
| KB_USER: ${{ secrets.KB_USER }} | |
| KB_PASSWORD: ${{ secrets.KB_PASSWORD }} | |
| run: python dashboard/generate.py | |
| - uses: actions/configure-pages@v5 | |
| - uses: actions/upload-pages-artifact@v3 | |
| with: | |
| path: dashboard/site | |
| - id: deploy | |
| uses: actions/deploy-pages@v4 |