CI: enable archive and toggle visibility

.github/workflows/main.yml

@@ -5,8 +5,8 @@ on:
       - master
   pull_request:
   schedule:
-    - cron: '0 5 * * *'  # Runs at 05:00 UTC
-    - cron: '0 17 * * *' # Runs at 1:00 UTC
+    - cron: '17 5 * * *'  # Runs at 05:17 UTC
+    - cron: '17 17 * * *' # Runs at 17:17 UTC
   workflow_dispatch:
 
 concurrency:
@@ -39,6 +39,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: SukkaLab/ruleset.skk.moe
+          # during a race condition the dist repo may be private, use token to clone
+          token: ${{ secrets.GIT_TOKEN }}
           persist-credentials: false
           filter: "tree:0" # we don't care about git history here
           fetch-tags: false
@@ -131,12 +133,15 @@ jobs:
           path: public
       - name: Diff
         run: |
-          git clone --filter=tree:0 --no-tags https://github.com/SukkaLab/ruleset.skk.moe.git ./deploy-git >/dev/null 2>&1
+          git clone --filter=tree:0 --no-tags https://${GH_USER}:${GH_TOKEN}@github.com/SukkaLab/ruleset.skk.moe.git ./deploy-git >/dev/null 2>&1
           cd ./deploy-git
           git fetch origin master >/dev/null 2>&1
           rm -rf ./*
           cp -rf ../public/* ./
           git --no-pager diff --minimal
+        env:
+          GH_USER: ${{ secrets.GIT_USER }}
+          GH_TOKEN: ${{ secrets.GIT_TOKEN }}
 
   deploy_to_cloudflare_pages:
     needs:
@@ -203,7 +208,12 @@ jobs:
           GITLAB_USER: ${{ secrets.GITLAB_USER }}
           GITLAB_TOKEN_NAME: ${{ secrets.GITLAB_TOKEN_NAME }}
           GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
+      - name: Prepare GitHub Pages deployment marker
+        id: deploy_marker
+        run: |
+          echo "marker_file=deploy-check-${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}.txt" >> $GITHUB_OUTPUT
       - name: Upload Dist to GitHub
+        id: upload_dist_to_github
         continue-on-error: true
         run: |
           gh repo unarchive SukkaLab/ruleset.skk.moe --yes
@@ -215,16 +225,39 @@ jobs:
           rm -rf ./*
           cp -rf ../public/* ./
           echo "ruleset-mirror.skk.moe" > CNAME
+          : > "${{ steps.deploy_marker.outputs.marker_file }}"
           git add --all .
           git commit -m "deploy: https://github.com/SukkaW/Surge/commit/${GITHUB_SHA}"
           git push --quiet --force origin HEAD:master
           cd ..
           rm -rf ./deploy-git
-          # gh repo archive SukkaLab/ruleset.skk.moe --yes
         env:
           GH_EMAIL: ${{ secrets.GIT_EMAIL }}
           GH_USER: ${{ secrets.GIT_USER }}
           GH_TOKEN: ${{ secrets.GIT_TOKEN }}
+      - name: Wait for GitHub Pages to serve deployed marker
+        if: steps.upload_dist_to_github.outcome == 'success'
+        id: wait_for_github_pages
+        run: |
+          marker_file="${{ steps.deploy_marker.outputs.marker_file }}"
+          marker_url="https://ruleset-mirror.skk.moe/${marker_file}"
+
+          for _ in $(seq 1 30); do
+            if curl --fail --silent --show-error --location --head "${marker_url}" >/dev/null; then
+              echo "GitHub Pages is serving ${marker_file}"
+              exit 0
+            fi
+            sleep 10
+          done
+
+          echo "Timed out waiting for GitHub Pages deployment: ${marker_url}"
+          exit 1
+      - name: Archive dist repo
+        if: steps.wait_for_github_pages.outcome == 'success'
+        run: |
+          gh repo archive SukkaLab/ruleset.skk.moe --yes
+        env:
+          GH_TOKEN: ${{ secrets.GIT_TOKEN }}
   remove_artifacts:
     needs:
       - deploy_to_cloudflare_pages

.github/workflows/toggle-dist-repo-visibility.yml

@@ -0,0 +1,68 @@
+name: Toggle Dist Repo Visibility
+on:
+  schedule:
+    # Runs at 22:47 UTC every Sunday
+    # This also avoids hitting our own auto build schedule at 05:17 and 17:17 UTC
+    - cron: '47 14 * * 0'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  toggle_dist_repo_visibility:
+    name: Toggle Dist Repo Visibility
+    runs-on: ubuntu-slim
+    steps:
+      - name: Make dist repo private
+        env:
+          GH_TOKEN: ${{ secrets.GIT_TOKEN }}
+        run: |
+          gh repo unarchive SukkaLab/ruleset.skk.moe --yes
+          gh repo edit SukkaLab/ruleset.skk.moe \
+            --visibility private \
+            --accept-visibility-change-consequences
+
+      - name: Wait for visibility change to settle
+        run: sleep 180
+
+      - name: Make dist repo public again
+        env:
+          GH_TOKEN: ${{ secrets.GIT_TOKEN }}
+        run: |
+          gh repo edit SukkaLab/ruleset.skk.moe \
+            --visibility public \
+            --accept-visibility-change-consequences
+
+      - name: Restore GitHub Pages branch deployment
+        env:
+          GH_TOKEN: ${{ secrets.GIT_TOKEN }}
+        # After we toggle the visibility, GitHub Pages WILL get taken down
+        # But just in case, we still detect and use both PUT/POST
+        run: |
+          if gh api repos/SukkaLab/ruleset.skk.moe/pages >/dev/null 2>&1; then
+            gh api \
+              --method PUT \
+              -H "Accept: application/vnd.github+json" \
+              -H "X-GitHub-Api-Version: 2026-03-10" \
+              repos/SukkaLab/ruleset.skk.moe/pages \
+              -f "build_type=legacy" \
+              -f "source[branch]=master" \
+              -f "source[path]=/"
+          else
+            gh api \
+              --method POST \
+              -H "Accept: application/vnd.github+json" \
+              -H "X-GitHub-Api-Version: 2026-03-10" \
+              repos/SukkaLab/ruleset.skk.moe/pages \
+              -f "build_type=legacy" \
+              -f "source[branch]=master" \
+              -f "source[path]=/"
+          fi
+
+      - name: Archive dist repo again
+        env:
+          GH_TOKEN: ${{ secrets.GIT_TOKEN }}
+        run: |
+          gh repo archive SukkaLab/ruleset.skk.moe --yes