name: refresh# Refreshes every six hours from keyless sources. A failed source keeps its last good snapshot and the page says so.# Three jobs, so the one that parses downloaded data can neither push nor deploy.on:  schedule:    - cron: "17 */6 * * *"  workflow_dispatch:    inputs:      bigquery:        description: "BigQuery for this run: auto runs the rolling queries on the midnight refresh only"        type: choice        options: [auto, light, full]        default: autopermissions: {}concurrency:  group: refresh  cancel-in-progress: falsejobs:  build:    if: github.ref == 'refs/heads/main'    runs-on: ubuntu-latest    timeout-minutes: 30    environment: bigquery    permissions:      contents: read    steps:      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1        with:          persist-credentials: false      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0        with:          python-version: "3.12"      - name: Pull, rebuild, verify        env:          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}          GITHUB_TOKEN: ${{ github.token }} # read-only in this job          WANT_BQ: ${{ inputs.bigquery }}        run: |          FLAGS=""          if [ "$WANT_BQ" = "full" ]; then FLAGS="--bq"          elif [ "$WANT_BQ" = "light" ] || [ "$(date -u +%H)" = "00" ]; then FLAGS="--bq-light"; fi          if [ -n "$FLAGS" ] && [ -n "$GCP_SA_KEY" ]; then            pip install --require-hashes --only-binary :all: -r requirements-bq.txt            umask 077            KEY="$(mktemp -p "$RUNNER_TEMP")"            trap 'rm -f "$KEY"' EXIT            printf '%s' "$GCP_SA_KEY" | base64 -d > "$KEY"            export GOOGLE_APPLICATION_CREDENTIALS="$KEY"          fi          unset GCP_SA_KEY          python3 run.py $FLAGS      - name: The ledger may only grow        run: |          if git cat-file -e HEAD:ledger/grades.jsonl 2>/dev/null; then            git show HEAD:ledger/grades.jsonl > "$RUNNER_TEMP/old-ledger"            cmp -n "$(wc -c < "$RUNNER_TEMP/old-ledger")" "$RUNNER_TEMP/old-ledger" ledger/grades.jsonl          fi      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2        with:          name: refreshed-data          path: |            raw/            ledger/            docs/          retention-days: 1          if-no-files-found: error  publish:    needs: build    runs-on: ubuntu-latest    timeout-minutes: 10    permissions:      contents: write    steps:      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2        with:          name: refreshed-data          path: .      - name: Commit the new snapshot        run: |          git config user.name "github-actions[bot]"          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"          git add raw ledger docs          git diff --cached --quiet || git commit -m "data refresh $(date -u +%FT%H:%MZ)"          git push  deploy:    needs: publish    # Pages needs a public repo. Set the repo variable PAGES_ENABLED to true when the repo goes public.    if: vars.PAGES_ENABLED == 'true'    runs-on: ubuntu-latest    timeout-minutes: 10    permissions:      pages: write      id-token: write    environment:      name: github-pages      url: ${{ steps.deploy.outputs.page_url }}    steps:      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2        with:          name: refreshed-data          path: refreshed      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0        with:          path: refreshed/docs      - id: deploy        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1