name: Purge Fastly

# **What it does**:

# On production deploy, hard-purge the changed English content pages by key.

# On demand, soft or hard purge language keys, a single key, or entire cache.

# **Why we have it**: So a just-deployed change is visible right away, and so

# docs engineering can clear a bad cache state without the Fastly UI.

# **Who does it impact**: Writers and engineers. A full purge impacts all readers

# and spikes origin traffic while the cache refills, so it's gated below.

on:

deployment_status:

workflow_dispatch:

inputs:

languages:

description: "Languages: Comma separated languages, e.g. 'en,es,ja,pt,zh,ru,fr,ko,de'. Blank = all languages."

required: false

default: 'en'

hard:

description: 'Hard purge: Evict immediately instead of the default soft purge. Use when a soft purge fails to clear stale content.'

type: boolean

required: false

default: false

everything:

description: 'Everything: Hard-purge the entire Fastly cache... every key, all readers. Ignores the languages/hard inputs. To confirm, type exactly: "purge everything". Otherwise leave blank.'

required: false

default: ''

permissions:

contents: read

deployments: read

# Serialize full-cache purges so two can't overlap and leave the cache in an

# unknown state. Every other run (per-deploy, per-language) gets a unique group

# so those never block each other.

concurrency:

group: ${{ (inputs.everything == 'purge everything' && 'purge-fastly-all') || format('purge-fastly-{0}', github.run_id) }}

cancel-in-progress: false

env:

FASTLY_TOKEN: ${{ secrets.FASTLY_TOKEN }}

FASTLY_SERVICE_ID: ${{ secrets.FASTLY_SERVICE_ID }}

jobs:

send-purges:

# Run when workflow_dispatch is the event

# or when deployment_status is the event and it's a successful production deploy.

# NOTE: This workflow triggers on all deployment_status events,

# including staging, but only runs for production.

# Non-production deploys will show as "skipped" - this is expected behavior.

if: >-

${{

github.repository == 'github/docs-internal' &&

(github.event_name != 'deployment_status' ||

github.event.deployment_status.state == 'success' && github.event.deployment_status.environment == 'production')

}}

runs-on: ubuntu-latest

steps:

- name: Check out repo

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- uses: ./.github/actions/node-npm-setup

- name: Validate confirmation input

# A full-cache purge only triggers on the exact string "purge everything".

# Any other non-empty value (e.g. a typo) would otherwise be silently

# ignored and fall through to a normal soft purge that finishes green, so

# an operator could think they evicted the whole cache when they didn't.

# Fail loudly instead.

env:

EVERYTHING_INPUT: ${{ inputs.everything }}

run: |

if [ -n "$EVERYTHING_INPUT" ] && [ "$EVERYTHING_INPUT" != "purge everything" ]; then

echo "::error::To purge the entire cache, the 'everything' input must be exactly 'purge everything'. Got: '$EVERYTHING_INPUT'. Leave it blank for a normal purge."

exit 1

fi

- name: Wait for production to serve this build

if: ${{ github.event_name == 'deployment_status' }}

run: npm run wait-for-build

- name: Purge Fastly (manual)

# Raw inputs are passed through the environment and quoted, never spliced

# into the command string, so a value like `en' --everything` can't break

# out of its argument and inject another flag.

if: ${{ github.event_name == 'workflow_dispatch' }}

env:

LANGUAGES_INPUT: ${{ inputs.languages }}

HARD_INPUT: ${{ inputs.hard }}

EVERYTHING_INPUT: ${{ inputs.everything }}

run: |

args=()

if [ -n "$LANGUAGES_INPUT" ]; then

args+=(--languages "$LANGUAGES_INPUT")

fi

if [ "$HARD_INPUT" = "true" ]; then

args+=(--hard)

fi

if [ "$EVERYTHING_INPUT" = "purge everything" ]; then

args+=(--everything)

fi

npm run purge-fastly -- "${args[@]}"

- name: Hard-purge changed English content pages

# On prod deploys, evict the surrogate keys of the English content pages

# whose content/ files changed in this deploy.

if: ${{ github.event_name == 'deployment_status' }}

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

HEAD_SHA: ${{ github.event.deployment.sha }}

run: npm run purge-fastly-changed-content

- uses: ./.github/actions/create-workflow-failure-issue

id: create-failure-issue

if: ${{ failure() && github.event_name != 'workflow_dispatch' }}

with:

token: ${{ secrets.DOCS_BOT_PAT_BASE }}

- uses: ./.github/actions/slack-alert

if: ${{ failure() && github.event_name != 'workflow_dispatch' }}

with:

slack_token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}

issue_url: ${{ steps.create-failure-issue.outputs.issue_url }}