Upgrade pelican and related stuff, remove fabric, add diff workflows

.github/scripts/render-site-diff.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 3 ]]; then
+    echo "usage: $0 OLD_OUTPUT NEW_OUTPUT REPORT_DIR" >&2
+    exit 2
+fi
+
+old_output=$(realpath "$1")
+new_output=$(realpath "$2")
+report=$(realpath -m "$3")
+staging=$(mktemp -d)
+trap 'rm -rf "$staging"' EXIT
+
+mkdir -p "$report" "$staging/old" "$staging/new"
+
+stage_output() {
+    local source=$1 destination=$2
+
+    # HTML is the review target. Feeds, gzip output and build_info.txt are
+    # intentionally absent, as their generated representation is not stable.
+    while IFS= read -r -d '' path; do
+        relative=${path#"$source"/}
+        mkdir -p "$destination/$(dirname "$relative")"
+        cp "$path" "$destination/$relative"
+    done < <(find "$source" -type f -name '*.html' -print0)
+
+    # Binary files do not belong in a textual diff, but their checksums catch
+    # missing or changed uploads (the failure mode that prompted this check).
+    if [[ -d "$source/uploads" ]]; then
+        (
+            cd "$source/uploads"
+            find . -type f -print0 | sort -z | xargs -0 sha256sum
+        ) > "$destination/uploads.sha256"
+    fi
+}
+
+stage_output "$old_output" "$staging/old"
+stage_output "$new_output" "$staging/new"
+
+set +e
+diff -ruN -U 5 "$staging/old" "$staging/new" > "$report/site.diff"
+diff_status=$?
+set -e
+if [[ $diff_status -gt 1 ]]; then
+    echo "diff failed with status $diff_status" >&2
+    exit "$diff_status"
+fi
+
+old_html=$(find "$staging/old" -type f -name '*.html' | wc -l)
+new_html=$(find "$staging/new" -type f -name '*.html' | wc -l)
+changed=$(diff -qr "$staging/old" "$staging/new" 2>/dev/null | wc -l || true)
+cat > "$report/summary.md" <<EOF
+# Base/branch generated-site comparison
+
+- Base HTML files: $old_html
+- Branch HTML files: $new_html
+- Changed or missing files (including the upload manifest): $changed
+- Excluded by design: feeds, compressed files, and build_info.txt
+
+Open \`site-diff.html\` for the side-by-side report or \`site.diff\` for the
+underlying unified diff.
+EOF
+
+if [[ -s "$report/site.diff" ]]; then
+    diff2html -i file -s side -d word --lm lines --su open \
+        -F "$report/site-diff.html" -- "$report/site.diff"
+else
+    cat > "$report/site-diff.html" <<'EOF'
+<!doctype html><meta charset="utf-8"><title>No renderer differences</title>
+<h1>No renderer differences</h1>
+<p>The staged HTML and upload checksum manifests are identical.</p>
+EOF
+fi

.github/workflows/content-diff.yaml

@@ -0,0 +1,62 @@
+name: Compare rendering after content changes
+
+on:
+  pull_request:
+    paths:
+      - 'content/**'
+  workflow_dispatch:
+    inputs:
+      base_ref:
+        description: Git ref to compare against
+        required: true
+        default: master
+
+permissions:
+  contents: read
+
+jobs:
+  content-diff:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out base revision
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.base.sha || inputs.base_ref }}
+          path: base
+
+      - name: Check out branch revision
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          path: branch
+
+      - name: Build unminified base output
+        run: docker build --target builder --build-arg BUILD_MODE=debug -t website-base base
+
+      - name: Build unminified branch output
+        run: docker build --target builder --build-arg BUILD_MODE=debug -t website-branch branch
+
+      - name: Export generated sites
+        run: |
+          mkdir -p output/base output/branch
+          docker create --name website-base-export website-base
+          docker create --name website-branch-export website-branch
+          docker cp website-base-export:/site/output/. output/base/
+          docker cp website-branch-export:/site/output/. output/branch/
+
+      - name: Install HTML diff renderer
+        run: npm install --global diff2html-cli@5.1.2
+
+      - name: Generate browsable comparison
+        run: bash branch/.github/scripts/render-site-diff.sh output/base output/branch report
+
+      - name: Add comparison summary
+        run: cat report/summary.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload HTML and raw diff
+        uses: actions/upload-artifact@v7
+        with:
+          name: base-branch-content-diff
+          path: report/
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/renderer-diff.yaml

@@ -0,0 +1,63 @@
+name: Compare rendering after code changes
+
+on:
+  pull_request:
+    paths-ignore:
+      - 'content/**'
+  workflow_dispatch:
+    inputs:
+      base_ref:
+        description: Git ref to compare against
+        required: true
+        default: master
+
+permissions:
+  contents: read
+
+jobs:
+  renderer-diff:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out base revision
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.base.sha || inputs.base_ref }}
+          path: base
+
+      - name: Check out branch revision
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          path: branch
+
+      - name: Build unminified base output
+        run: docker build --target builder --build-arg BUILD_MODE=debug -t website-base base
+
+      - name: Build unminified branch output
+        run: docker build --target builder --build-arg BUILD_MODE=debug -t website-branch branch
+
+      - name: Export generated sites
+        run: |
+          mkdir -p output/base output/branch
+          docker create --name website-base-export website-base
+          docker create --name website-branch-export website-branch
+          docker cp website-base-export:/site/output/. output/base/
+          docker cp website-branch-export:/site/output/. output/branch/
+
+      - name: Install HTML diff renderer
+        run: npm install --global diff2html-cli@5.1.2
+
+      - name: Generate browsable comparison
+        run: bash branch/.github/scripts/render-site-diff.sh output/base output/branch report
+
+      - name: Add comparison summary
+        run: cat report/summary.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload HTML and raw diff
+        uses: actions/upload-artifact@v7
+        with:
+          name: base-branch-renderer-diff
+          path: report/
+          if-no-files-found: error
+          retention-days: 30
+

Dockerfile

@@ -1,26 +1,13 @@
-FROM python:3.5-slim AS builder
+FROM python:3.13-slim AS builder
 
 WORKDIR /site
 ARG BUILD_MODE=prod
 ENV BUILD_MODE=${BUILD_MODE}
 
-RUN printf '%s\n' \
-    'deb https://archive.debian.org/debian buster main' \
-    'deb https://archive.debian.org/debian-security buster/updates main' \
-    > /etc/apt/sources.list \
-    && printf 'Acquire::Check-Valid-Until "false";\n' > /etc/apt/apt.conf.d/99archive \
-    && apt-get update \
-    && apt-get install -y --no-install-recommends \
-    build-essential \
-    libxml2-dev \
-    libxslt1-dev \
-    zlib1g-dev \
-    openssh-client \
-    && rm -rf /var/lib/apt/lists/*
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 COPY . .
-RUN fab build:${BUILD_MODE}
+RUN pelican -s pelicanconf-${BUILD_MODE}.py
 
 FROM alpine:latest AS final