Add standalone website build workflow (#7342)

Extract website build into a separate GitHub Actions workflow that
does not depend on the build-image container. This is Phase 1:
both the new workflow and the existing build job produce website
artifacts in parallel for comparison.

The deploy job is disabled (false condition) until Phase 2 when
we remove the website build from test-build-deploy.yml.

Signed-off-by: Friedrich Gonzalez <1517449+friedrichg@users.noreply.github.com>

Author: friedrichg

.github/workflows/test-build-deploy.yml

@@ -38,10 +38,6 @@ jobs:
         run: make BUILD_IN_CONTAINER=false mod-check
       - name: Check Protos
         run: make BUILD_IN_CONTAINER=false check-protos
-      - name: Check Generated Documentation
-        run: make BUILD_IN_CONTAINER=false check-doc
-      - name: Check White Noise.
-        run: make BUILD_IN_CONTAINER=false check-white-noise
       - name: Check Modernize
         run: make BUILD_IN_CONTAINER=false check-modernize
 
@@ -328,7 +324,7 @@ jobs:
 
   deploy_website:
     needs: [build, test, lint]
-    if: github.ref == 'refs/heads/master' && github.repository == 'cortexproject/cortex'
+    if: false && github.ref == 'refs/heads/master' && github.repository == 'cortexproject/cortex'
     runs-on: ubuntu-24.04
     container:
       image: quay.io/cortexproject/build-image:master-fe84258322

.github/workflows/web.yml

@@ -0,0 +1,99 @@
+name: website
+permissions: read-all
+on:
+  push:
+    branches: [master]
+    paths-ignore:
+      - 'build-image/**'
+      - '.github/workflows/build-image.yml'
+  pull_request:
+    paths-ignore:
+      - 'build-image/**'
+      - '.github/workflows/build-image.yml'
+
+jobs:
+  lint:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Setup Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version-file: go.mod
+          cache: false
+      - name: Check Generated Documentation
+        run: make BUILD_IN_CONTAINER=false check-doc
+      - name: Check White Noise
+        run: make BUILD_IN_CONTAINER=false check-white-noise
+
+  build:
+    needs: [lint]
+    runs-on: ubuntu-24.04
+    env:
+      HUGO_VERSION: "0.101.0"
+      NODE_VERSION: "18"
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          submodules: recursive
+      - name: Setup Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version-file: go.mod
+          cache: false
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+      - name: Install Hugo
+        run: |
+          curl -sLJO "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_Linux-64bit.tar.gz"
+          mkdir -p "${HOME}/.local/hugo"
+          tar -C "${HOME}/.local/hugo" -xf "hugo_extended_${HUGO_VERSION}_Linux-64bit.tar.gz"
+          rm "hugo_extended_${HUGO_VERSION}_Linux-64bit.tar.gz"
+          echo "${HOME}/.local/hugo" >> "${GITHUB_PATH}"
+      - name: Install Node.js dependencies
+        working-directory: website
+        run: npm ci
+      - name: Build Website
+        run: |
+          ./tools/website/web-pre.sh
+          cd website && HUGO_ENV=production hugo --config config.toml --minify -v
+      - name: Upload Website Artifact
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: website public standalone
+          path: website/public/
+
+  deploy:
+    needs: [build]
+    if: github.ref == 'refs/heads/master' && github.repository == 'cortexproject/cortex'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ssh-key: ${{ secrets.WEBSITE_DEPLOY_SSH_PRIVATE_KEY }}
+      - name: Download Website Artifact
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: website public standalone
+          path: website/public
+      - name: Setup SSH Keys
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan github.com >> ~/.ssh/known_hosts
+          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
+          ssh-add - <<< "${{ secrets.WEBSITE_DEPLOY_SSH_PRIVATE_KEY }}"
+        env:
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        shell: bash
+      - name: Deploy Website
+        run: ./tools/website/web-deploy.sh
+        env:
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+          GIT_SSH_COMMAND: "ssh -o StrictHostKeyChecking=no"