website: publish the RISC-V wheels dashboard at /dashboard (#2589)

The dashboard is the first reference for picking packages to port, but it
lived only on a separate site. Serve it alongside the package index,
regenerated on each publish from main.

Generator vendored from riseproject-dev/python-wheels-dashboard@edcf127,
which stays upstream and keeps its own site.

Author: luhenry

.github/workflows/website.yml

@@ -8,17 +8,14 @@ on:
     branches: [main]
     paths:
       - "docs/**"
+      - "ci_scripts/dashboard/**"
   pull_request:
     types: [opened, synchronize, reopened, closed]
     paths:
       - "docs/**"
+      - "ci_scripts/dashboard/**"
   workflow_dispatch:
 
-concurrency:
-  group: website
-  cancel-in-progress: false
-  queue: max
-
 jobs:
   setup:
     if: github.event_name != 'pull_request' || github.actor != 'dependabot[bot]'
@@ -27,20 +24,21 @@ jobs:
       - run: true
 
   preview:
+    if: github.event_name == 'pull_request'
     needs: [setup]
     runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         if: github.event.action != 'closed'
         with:
           python-version: '3'
 
-      - name: Install package doc generator dependencies
+      - name: Install site generator dependencies
         if: github.event.action != 'closed'
         run: pip install -r ci_scripts/requirements.txt
 
@@ -54,7 +52,7 @@ jobs:
         run: |
           echo "value=/pr-preview/pr-${{ github.event.number }}" >> "$GITHUB_OUTPUT"
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8  # v1.327.0
         if: github.event.action != 'closed'
         with:
           ruby-version: '3.3'
@@ -86,7 +84,7 @@ jobs:
       # occasionally not live for a few seconds is a smaller problem than a
       # misleading red X on an otherwise-working PR.
       - name: Deploy or remove PR preview
-        uses: rossjrw/pr-preview-action@v1
+        uses: rossjrw/pr-preview-action@ffa7509e91a3ec8dfc2e5536c4d5c1acdf7a6de9  # v1.8.1
         with:
           source-dir: ./_site
 
@@ -97,26 +95,43 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3'
 
-      - name: Install package doc generator dependencies
+      - name: Install site generator dependencies
         run: pip install -r ci_scripts/requirements.txt
 
       - name: Generate package pages from YAML
         run: python ci_scripts/generate_packages_doc.py
 
+      - name: Restore the dashboard's pypi.org response cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        with:
+          path: ${{ runner.temp }}/dashboard/requests-cache.sqlite
+          key: requests-cache-${{ github.ref }}
+          restore-keys: requests-cache-main
+
+      # build.py stages nothing unless the result is complete, and keep_files
+      # leaves the previous dashboard serving, so an upstream data outage must
+      # not block a docs deploy.
+      - name: Generate the dashboard
+        continue-on-error: true
+        run: |
+          python ci_scripts/dashboard/build.py \
+            --build-dir "${{ runner.temp }}/dashboard" \
+            --output-dir docs/dashboard
+
       - name: Build with Jekyll
-        uses: actions/jekyll-build-pages@v1
+        uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697  # v1.0.13
         with:
           source: ./docs
           destination: ./_site
 
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./_site

ci_scripts/dashboard/.gitignore

@@ -0,0 +1 @@
+__pycache__/

ci_scripts/dashboard/LICENSE

@@ -0,0 +1,24 @@
+Copyright (c) 2013, Charlie Denton
+              2026, Stan Ulbrych
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+    this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright notice,
+    this list of conditions and the following disclaimer in the documentation
+    and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

ci_scripts/dashboard/README.md

@@ -0,0 +1,80 @@
+# Vendored RISC-V Wheels dashboard generator
+
+This directory is a **vendored copy** of the dashboard generator from
+<https://github.com/riseproject-dev/python-wheels-dashboard>, used to publish the
+dashboard at <https://pypi.riseproject.dev/dashboard/> as part of this repo's
+website build (`.github/workflows/website.yml`, `deploy` job).
+
+The dashboard repo remains the **upstream source of truth**. It keeps its own
+GitHub Pages site and its own 6-hourly refresh; this copy is regenerated on each
+publish from `main`. The two sites can legitimately disagree by a few hours.
+
+Vendored from commit **`edcf127`** ("Persist pypi.org request cache across CI
+runs, pin actions to SHAs").
+
+## Licensing
+
+The upstream project is BSD-2-Clause, whose clause 1 requires retaining the
+copyright notice, so `LICENSE` is shipped verbatim and the vendored files carry
+BSD-2-Clause SPDX headers. Only `build.py` is RISE-authored and MIT, matching the
+rest of this repo.
+
+## Files
+
+| File | Origin |
+|---|---|
+| `LICENSE` | verbatim from upstream |
+| `generate.py`, `utils.py`, `svg_wheel.py` | upstream, SPDX header prepended |
+| `wheel.css`, `favicon.ico` | verbatim from upstream |
+| `index.html` | upstream, with the text edits listed below |
+| `build.py` | **new**, RISE-authored — not upstream |
+
+The generator's own dependencies (`requests`, `requests-cache`) live in
+`ci_scripts/requirements.txt` alongside the rest of this repo's CI Python deps;
+upstream's `pre-commit` pin is dropped, as there are no local hooks here.
+
+`build.py` holds all python-wheels-specific logic so that the upstream files stay
+a clean copy. It fetches and sanity-checks the package list, runs `generate.py` in
+a scratch directory, validates the result, and only then stages five files into
+the Jekyll source tree.
+
+## Resyncing from upstream
+
+```bash
+cd ci_scripts/dashboard
+UP=/path/to/python-wheels-dashboard
+cp "$UP"/{LICENSE,generate.py,utils.py,svg_wheel.py,index.html,wheel.css,favicon.ico} .
+```
+
+Then re-apply the local deltas:
+
+1. Prepend the BSD-2-Clause SPDX header to `generate.py`, `utils.py` and
+   `svg_wheel.py` (copy it from a sibling file).
+2. Re-apply the `index.html` edits:
+   - drop the stale "top 360" figure from the "What is this list?" paragraph and
+     the "Thanks" paragraph — the generator applies no slice, so the real count
+     moves every run;
+   - change the footer cadence from "Updated daily." to the real cadence;
+   - keep the absolute link back to <https://pypi.riseproject.dev/> near the `<h1>`.
+3. If upstream changed its `requests`/`requests-cache` pins, update them in
+   `ci_scripts/requirements.txt`.
+4. Update the vendored commit SHA above.
+
+Leave `build.py` alone — it is not upstream.
+
+**Never add YAML front matter to `index.html`.** It contains AngularJS bindings
+(`{{ package.name }}`) that are also valid Liquid. The file is correct only
+because Jekyll treats it as a static file and copies it byte-for-byte; front
+matter would make Liquid eat the bindings and the package list would render empty
+with no build error. `build.py` asserts this.
+
+## Running it locally
+
+```bash
+pip install -r ../requirements.txt
+python build.py --build-dir /tmp/dash --output-dir ../../docs/dashboard
+```
+
+A cold run makes one pypi.org request per package (~15000 at 8 concurrency) and
+writes a multi-GB `requests-cache.sqlite` into the build dir, which is why the
+build dir is kept outside `docs/`.