[DOC] Fix deploy doc on main (nilearn#4455)

* try deploy doc from github

* adapt commit message

* test

* dump context

* prep message

* prep message

* adapt for nilearn upstream

* fix

* Apply suggestions from code review

* skip problematic filelock

* latest filelock was yanked

.circleci/config.yml

@@ -32,46 +32,6 @@ jobs:
                 paths:
                 -   html
 
-    deploy:
-        docker:
-        -   image: cimg/python:3.12
-        steps:
-        -   add_ssh_keys:
-                fingerprints:
-                -   19:56:86:2d:c6:df:02:f2:87:0e:59:a1:eb:b7:65:77
-        -   attach_workspace:
-                at: /tmp/_build
-        -   run:
-                name: Fetch docs
-                command: |
-                    set -x -e
-                    mkdir -p ~/.ssh
-                    ssh-keyscan github.com >> ~/.ssh/known_hosts;
-                    if [ ! -d ~/nilearn.github.io ]; then
-                        git clone [email protected]:nilearn/nilearn.github.io.git ~/nilearn.github.io --depth=1
-                    fi
-        -   run:
-                name: Deploy dev docs
-                command: |
-                    set -x -e
-                    if [ "${CIRCLE_BRANCH}" == "main" ]; then
-                      git config --global user.email "[email protected]";
-                      git config --global user.name "CircleCI";
-                      cd ~/nilearn.github.io;
-                      git checkout main
-                      git remote -v
-                      git fetch origin
-                      git reset --hard origin/main
-                      git clean -xdf
-                      echo "Deploying dev docs for ${CIRCLE_BRANCH}.";
-                      rm -Rf dev;
-                      cp -a /tmp/_build/html dev;
-                      git add -A;
-                      git commit -m "CircleCI update of dev docs (build: ${CIRCLE_BUILD_NUM}).";
-                      git push origin main;
-                    else
-                      echo "No deployment (build: ${CIRCLE_BRANCH}).";
-                    fi
 
 workflows:
 
@@ -82,10 +42,3 @@ workflows:
     # The jobs should run only when triggered by the workflow
         jobs:
         -   host_docs
-        -   deploy:
-                requires:
-                -   host_docs
-                filters:
-                    branches:
-                        only:
-                        -   main

.github/workflows/build-docs.yml

@@ -48,6 +48,7 @@ jobs:
         steps:
         -   name: Checkout nilearn
             uses: actions/checkout@v4
+
         -   name: Check whether the citation metadata from CITATION.cff is valid
             uses: citation-file-format/[email protected]
             with:
@@ -69,6 +70,7 @@ jobs:
                 # If pull request, checkout HEAD commit with all commit history
                 ref: ${{ github.event.pull_request.head.sha }}
                 fetch-depth: 0
+
         -   name: Merge with upstream
             run: ./build_tools/github/merge_upstream.sh
 
@@ -77,6 +79,7 @@ jobs:
             uses: actions/setup-python@v5
             with:
                 python-version: '3.12'
+
         -   name: Install packages
             run: |
                 python -m pip install --user --upgrade pip setuptools
@@ -222,7 +225,6 @@ jobs:
                 restore-keys: |
                     data_cache-${{ github.workflow }}_ref-${{ github.ref }}_run-${{ github.run_number }}
 
-
         # Update the authors file and the names file
         # in case a contributor has been added to citation.cff
         # but did not run the maint_tools/citation_cff_maint.py script.
@@ -245,22 +247,28 @@ jobs:
                 cd doc;
                 set -o pipefail;
                 PATTERN=$(cat ../pattern.txt) make $(cat ../build.txt) 2>&1 | tee log.txt;
+
         -   name: Check for unreplaced argument in docstrings
             if: always()
             run: |
                 ./build_tools/github/fill_doc_check.sh
                 cat doc/tmp/doc_check.txt
+
         -   name: Upload documentation
             if: steps.build-docs.outcome == 'success'
             uses: actions/upload-artifact@v4
             with:
                 name: doc
                 path: doc/_build/html
 
-        # Trigger hosting / deploy of the doc on nilearn.github.io via circle-ci
-        # We get the url for the artifacts for circle-ci from https://nightly.link/
+    deploy_on_pr:
+        runs-on: ubuntu-latest
+        needs: [build_docs]
+        if: ${{ github.event_name == 'pull_request'}}
+        steps:
+            # Trigger hosting / deploy of the doc on nilearn.github.io via circle-ci
+            # We get the url for the artifacts for circle-ci from https://nightly.link/
         -   name: Trigger hosting jobs on circle ci
-            if: steps.build-docs.outcome == 'success'
             run: |
                 GITHUB_RUN_URL="https://nightly.link/${{ github.repository }}/actions/runs/${{ github.run_id }}"
                 curl --request POST \
@@ -270,3 +278,49 @@ jobs:
                 --header "x-attribution-actor-id: github_actions" \
                 --header "x-attribution-login: github_actions" \
                 --data \{\"branch\":\"${{ github.head_ref }}\",\"parameters\":\{\"GITHUB_RUN_URL\":\"$GITHUB_RUN_URL\"\}\}
+
+    deploy_on_main:
+        runs-on: ubuntu-latest
+        needs: [build_docs]
+        if: ${{ contains(fromJSON('["push", "workflow_dispatch", "schedule"]'), github.event_name)}}
+        steps:
+        -   name: Add SSH key
+            env:
+                SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+            run: |
+                mkdir -p ~/.ssh
+                ssh-keyscan github.com >> ~/.ssh/known_hosts
+                echo "${{ secrets.ACTIONS_SSH_DEPLOY }}" > ~/.ssh/github_actions
+                chmod 600 ~/.ssh/github_actions
+                ssh-agent -a $SSH_AUTH_SOCK > /dev/null
+                ssh-add ~/.ssh/github_actions
+
+        -   uses: actions/download-artifact@v4
+            with:
+                name: doc
+                path: ~/doc/_build/html
+
+        -   name: deploy
+            env:
+                SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+            run: |
+                git config --global user.email "[email protected]"
+                git config --global user.name "GitHub actions"
+
+                git clone [email protected]:nilearn/nilearn.github.io.git ~/nilearn.github.io --depth=1
+                cd ~/nilearn.github.io;
+
+                git checkout main
+
+                git remote -v
+
+                git fetch origin
+                git reset --hard origin/main
+                git clean -xdf
+
+                echo "Deploying dev docs.";
+                rm -Rf dev;
+                cp -a ~/doc/_build/html dev;
+                git add -A;
+                git commit -m "Dev docs https://github.com/nilearn/nilearn/commit/${{ github.event.head_commit.id }} : ${{ github.event.head_commit.message }}";
+                git push origin main;