Move Documentation Job to GHA (#8718)

Summary:
This PR moves the doc gen job to gha. There are some minor changes compared to the original job:
- it uses the built-in `GITHUB_TOKEN` so it will no longer be necessary to keep an SSH key with full write access around.
  - The key currently used by CCI should be deleted once this is merged.
- only runs when changes happen in velox/docs
- runs in relevant PRs and uploads the generated docs as a shortlived artifact for easier review
- I removed the pyvelox build for now as the the API documentation wasn't generated/used. We can add this in when we want to use it, until then it's just wasted CI time.

I have also added a `dependabot.yml` to enable dependabot for Github Actions updates (this might need to be enabled in the repo settings). To avoid supply chain attacks via force pushed tag of actions we want to pin actions to a specific SHA when using actions in privileged workflows with permissions (e.g. `contents: write`) or that expose secrets. Dependabot will open PRs to update these SHAs (and the normal version tags)

Pull Request resolved: facebookincubator/velox#8718

Reviewed By: xiaoxmeng

Differential Revision: D54315010

Pulled By: kgpai

fbshipit-source-id: 4d284fe01352ec3c5191f6ff3748b13e2434bba3

.circleci/dist_compile.yml

@@ -425,43 +425,6 @@ jobs:
           fuzzer_exe: "_build/debug/velox/exec/tests/velox_join_fuzzer_test"
           fuzzer_args: " --seed ${RANDOM} --duration_sec 3600 --logtostderr=1 --minloglevel=0"
 
-  doc-gen-job:
-    executor: build
-    steps:
-      - checkout
-      - update-submodules
-      - add_ssh_keys:
-          fingerprints:
-            - "7b:24:f3:1a:b1:15:97:c6:fe:06:46:27:3e:b7:6b:96"
-      - run:
-          name: "Build docs and update gh-pages"
-          command: |
-            for i in {1..3}; do
-              make clean
-              git config --global user.email "velox@users.noreply.github.com"
-              git config --global user.name "velox"
-              git checkout main
-              conda init bash
-              source ~/.bashrc
-              conda create -y --name docgenenv python=3.7
-              conda activate docgenenv
-              pip install sphinx sphinx-tabs breathe sphinx_rtd_theme chardet
-              source /opt/rh/gcc-toolset-9/enable
-              ./scripts/gen-docs.sh docgenenv
-              git checkout gh-pages
-              cp -R velox/docs/_build/html/* docs
-              git add docs
-              if [ -n "$(git status --porcelain --untracked-files=no)" ]
-              then
-                git commit -m "Update documentation"
-                git push
-                if [ $? -eq 0 ]; then
-                  break;
-                fi
-              fi
-            done
-
-
   linux-pr-fuzzer-run:
     executor: build
     steps:
@@ -566,11 +529,6 @@ workflows:
       - linux-build-options
       - linux-adapters
       - linux-presto-fuzzer-run
-      - doc-gen-job:
-          filters:
-            branches:
-              only:
-                - main
 
   shorter-fuzzer:
     unless: << pipeline.parameters.run-longer-expression-fuzzer >>
@@ -579,8 +537,3 @@ workflows:
       - linux-pr-fuzzer-run
       - linux-build-options
       - linux-adapters
-      - doc-gen-job:
-          filters:
-            branches:
-              only:
-                - main

.github/dependabot.yml

@@ -0,0 +1,21 @@
+# Copyright (c) Facebook, Inc. and its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+

.github/workflows/docs.yml

@@ -0,0 +1,85 @@
+# Copyright (c) Facebook, Inc. and its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Update Documentation
+
+on:
+  push:
+    paths:
+      - "velox/docs/**"
+      - ".github/workflows/docs.yml"
+
+  pull_request:
+    paths:
+      - "velox/docs/**"
+      - ".github/workflows/docs.yml"
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.head_ref || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  build_docs:
+    name: Build and Push
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 0
+
+      - name: Setup Git User
+        run: |
+          git config --global user.email "velox@users.noreply.github.com"
+          git config --global user.name "velox"
+
+      - name: Install Dependencies
+        run: |
+          sudo apt update
+          sudo apt install -y pandoc
+          pip install sphinx sphinx-tabs breathe sphinx_rtd_theme chardet
+
+      - name: Build Documentation
+        run: |
+          cd velox/docs
+          make clean
+          # pyvelox
+          mkdir -p bindings/python
+          pandoc ../../pyvelox/README.md --from markdown --to rst -s -o bindings/python/README_generated_pyvelox.rst
+          # velox
+          make html
+
+      - name: Push Documentation
+        if: ${{ github.event_name == 'push' && github.repository == 'facebookincubator/velox'}}
+        run: |
+          git checkout gh-pages
+          cp -R velox/docs/_build/html/* docs
+          git add docs
+
+          if [ -n "$(git status --porcelain --untracked-files=no)" ]
+          then
+            git commit -m "Update documentation"
+            git push
+          fi
+
+      - name: Upload Documentation
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        with:
+          path: velox/docs/_build/html
+          retention-days: 3