slsa-framework
slsa repo should use a late-branching strategy for specification versions
problems:
- it's hard to edit and find the right versions of the right files when multiple versions are all in the same revision
- it's hard to compare the changes between revisions in git.
- netlify deployments are mysterious
proposal:
- [ ] add devcontainer (codespaces) support for deployment flows
- [ ] generate branches instead of folders for the different specifications.
- [ ] in each branch, move the content into a single canonical location (docs/spec)
- [ ] address any image references that have escaped their versioned spec folders
- [ ] update netlify build command to run a custom builder script
- [ ] point netlify at a custom build folder instead of the /docs folder
- [ ] add actions workflow to deploy site
Previous context:
As discussed today it would be great if someone could look at making adjustments so that changes are made via branches. This is a meta issue and not directly related to the specification (independent).
This could be done using GitHub Actions and/or Netlify.
This would be a great issue for those wanting to contribute with CI-CD/DevOps skills but unsure where to start helping!
If using GitHub Actions, it seems reasonable that it may be possible to update some portion of a gh-pages branch based on the source branch. For example, a v1 branch might only push the content in a v1 directory. Changes to a main branch would only update the files present outside of a version folder while also putting the versioned content in a latest "version."
If using Netlify, it seems like it should be straight forward but there might be a breaking change to using subdomains instead of modifying the URL path.
Related issue: #266 covers switching to Netlify for hosting. We can still make that change if desired. If we don't, the solution needs to keep working for our Netlify preview links, which we use extensively.
Prior art: https://github.com/iamwillbar/spdx-spec/blob/development/v2.3/.github/workflows/publish_common.yml is how spdx is sets up their GitHub Actions build
Status update: I'm working on this now while @chtiangg is out of town. However, one small snafu: git subtree split eliminates lot of merge commits, so the history becomes basically unreadable. (Currently you can do git log --first-parent to make the history at least somewhat readable.) I'll give git filter-repo a try...