Enforce noopener on cross-top-level-site Blob URLs #6621

	name: Build
	on:
	pull_request:
	branches:
	- main
	push:
	branches:
	- main
	jobs:
	build:
	name: Build
	runs-on: ubuntu-22.04
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 2
	path: 'source'
	- name: Build
	run: \|
	mkdir output
	docker run --mount "type=bind,source=$GITHUB_WORKSPACE/source,destination=/whatwg/html,readonly=1" \
	--env "HTML_SOURCE=/whatwg/html" \
	--mount "type=bind,source=$GITHUB_WORKSPACE/output,destination=/whatwg/output" \
	--env "HTML_OUTPUT=/whatwg/output" \
	ghcr.io/whatwg/html-build
	- name: Deploy
	if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
	env:
	SERVER: ${{ secrets.MARQUEE_SERVER }}
	SERVER_PUBLIC_KEY: ${{ secrets.MARQUEE_PUBLIC_KEY }}
	SERVER_DEPLOY_KEY: ${{ secrets.MARQUEE_DEPLOY_KEY }}
	run: \|
	eval "$(ssh-agent -s)"
	echo "$SERVER_DEPLOY_KEY" \| ssh-add -
	mkdir -p ~/.ssh/ && echo "$SERVER $SERVER_PUBLIC_KEY" > ~/.ssh/known_hosts

	# Sync, including deletes, but ignoring the stuff we'll deploy below, so that we don't delete them.
	# --chmod=D755,F644 means read-write for user, read-only for others.
	echo "Deploying build output..."
	rsync --archive --chmod=D755,F644 --compress --verbose \
	--delete --exclude="commit-snapshots" --exclude="review-drafts" \
	"$GITHUB_WORKSPACE/output/" "deploy@$SERVER:/var/www/html.spec.whatwg.org"

	echo ""
	echo "Deploying Commit Snapshot and Review Drafts, if any..."
	rsync --archive --chmod=D755,F644 --compress --verbose \
	"$GITHUB_WORKSPACE/output/commit-snapshots" "$GITHUB_WORKSPACE/output/review-drafts" "deploy@$SERVER:/var/www/html.spec.whatwg.org"

Provide feedback