Skip to content

Commit b73e9dd

Browse files
dlabajcursoragent
dlabaj
and
cursoragent
authored
fix(CI): split documentation workflow to avoid pull_request_target checkout block (#12625)
* fix(CI): split documentation workflow to avoid pull_request_target checkout block Rebased onto main and merged with the is-release workflow_call changes from #12598. PR builds use pull_request (artifact upload); deploy uses workflow_run. Closes #12601 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(CI): address PR review feedback on documentation deploy workflow - Deploy only when the Documentation workflow succeeds - Resolve PR number from workflow_run metadata with head_sha API fallback - Remove untrusted pr-number artifact from the build workflow - Upload PR artifacts only on successful build steps Co-authored-by: Cursor <cursoragent@cursor.com> * fix(CI): fail ambiguous documentation deploy PR lookups Require a unique pull request before deploying previews, and drop redundant always() checks in favor of !cancelled(). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 652853d commit b73e9dd

2 files changed

Lines changed: 106 additions & 11 deletions

File tree

‎.github/workflows/documentation-deploy.yml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
name: Documentation deploy
2+
on:
3+
workflow_run:
4+
workflows: [Documentation]
5+
types: [completed]
6+
permissions:
7+
actions: read
8+
contents: read
9+
pull-requests: read
10+
jobs:
11+
deploy:
12+
name: Deploy
13+
runs-on: ubuntu-latest
14+
if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
15+
env:
16+
SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }}
17+
SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
18+
GH_PR_TOKEN: ${{ secrets.GH_PR_TOKEN }}
19+
steps:
20+
- name: Check out project
21+
uses: actions/checkout@v4
22+
23+
- name: Set up project
24+
uses: ./.github/actions/setup-project
25+
with:
26+
skip-build: true
27+
28+
- name: Resolve PR number
29+
env:
30+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
31+
HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
32+
REPOSITORY: ${{ github.repository }}
33+
WORKFLOW_PRS: ${{ toJSON(github.event.workflow_run.pull_requests) }}
34+
run: |
35+
set -euo pipefail
36+
PR_COUNT=$(jq 'length // 0' <<< "${WORKFLOW_PRS:-null}")
37+
if [ "$PR_COUNT" -eq 1 ]; then
38+
PR_NUM=$(jq -r '.[0].number' <<< "$WORKFLOW_PRS")
39+
elif [ "$PR_COUNT" -eq 0 ]; then
40+
if ! [[ "$HEAD_SHA" =~ ^[0-9a-fA-F]{40,64}$ ]]; then
41+
echo "Invalid source workflow head SHA"
42+
exit 1
43+
fi
44+
PR_JSON=$(gh api --paginate "repos/${REPOSITORY}/commits/${HEAD_SHA}/pulls")
45+
PR_COUNT=$(jq 'length // 0' <<< "$PR_JSON")
46+
if [ "$PR_COUNT" -ne 1 ]; then
47+
echo "Failed to uniquely resolve PR number for commit ${HEAD_SHA} (found ${PR_COUNT} pull requests)"
48+
exit 1
49+
fi
50+
PR_NUM=$(jq -r '.[0].number' <<< "$PR_JSON")
51+
else
52+
echo "Ambiguous PR metadata: found ${PR_COUNT} pull requests on the source workflow run"
53+
exit 1
54+
fi
55+
if ! [[ "$PR_NUM" =~ ^[0-9]+$ ]]; then
56+
echo "Failed to resolve a valid PR number"
57+
exit 1
58+
fi
59+
echo "GH_PR_NUM=$PR_NUM" >> "$GITHUB_ENV"
60+
61+
- name: Download documentation
62+
uses: actions/download-artifact@v4
63+
with:
64+
name: documentation
65+
path: packages/react-docs/public
66+
run-id: ${{ github.event.workflow_run.id }}
67+
github-token: ${{ secrets.GITHUB_TOKEN }}
68+
69+
- name: Download a11y coverage
70+
uses: actions/download-artifact@v4
71+
with:
72+
name: a11y-coverage
73+
path: packages/react-docs/coverage
74+
run-id: ${{ github.event.workflow_run.id }}
75+
github-token: ${{ secrets.GITHUB_TOKEN }}
76+
77+
- name: Upload documentation
78+
run: node .github/upload-preview.mjs packages/react-docs/public
79+
80+
- name: Upload accessibility results
81+
if: ${{ !cancelled() }}
82+
run: node .github/upload-preview.mjs packages/react-docs/coverage

‎.github/workflows/documentation.yml‎

Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Documentation
22
on:
3-
pull_request_target:
3+
pull_request:
44
issue_comment:
55
types: [created]
66
workflow_call:
@@ -19,6 +19,7 @@ on:
1919
required: true
2020
jobs:
2121
check-permissions:
22+
if: github.event_name == 'issue_comment'
2223
uses: patternfly/.github/.github/workflows/check-team-membership.yml@fdb52a63a2220ec8a3b6c2d43f312cda708ffa06
2324
secrets: inherit
2425

@@ -27,39 +28,51 @@ jobs:
2728
runs-on: ubuntu-latest
2829
needs: check-permissions
2930
if: >-
30-
always() &&
31-
!cancelled() &&
32-
(inputs.is-release || needs.check-permissions.outputs.allowed == 'true')
31+
${{ !cancelled() &&
32+
(inputs.is-release || github.event_name != 'issue_comment' || needs.check-permissions.outputs.allowed == 'true') }}
3333
env:
3434
SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }}
3535
SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
3636
GH_PR_TOKEN: ${{ secrets.GH_PR_TOKEN }}
3737
GH_PR_NUM: ${{ needs.check-permissions.outputs.pr-number }}
3838
steps:
3939
- name: Check out project from PR branch
40-
if: github.event_name == 'pull_request_target' || github.event_name == 'issue_comment'
40+
if: github.event_name == 'issue_comment'
4141
uses: actions/checkout@v4
4242
with:
43-
# Checkout the merge commit so that we can access the PR's changes.
44-
# This is nessesary because `pull_request_target` checks out the base branch (e.g. `main`) by default.
4543
ref: refs/pull/${{ env.GH_PR_NUM }}/head
4644

4745
- name: Check out project
48-
if: inputs.is-release || github.event_name == 'workflow_call'
46+
if: github.event_name != 'issue_comment'
4947
uses: actions/checkout@v4
48+
5049
- name: Set up and build project
5150
uses: ./.github/actions/setup-project
5251

5352
- name: Build documentation
5453
run: yarn build:docs
5554

56-
- name: Upload documentation
57-
if: always()
55+
- name: Upload documentation preview
56+
if: ${{ !cancelled() && github.event_name != 'pull_request' }}
5857
run: node .github/upload-preview.mjs packages/react-docs/public
5958

6059
- name: Run accessibility tests
6160
run: yarn serve:docs & yarn test:a11y
6261

6362
- name: Upload accessibility results
64-
if: always()
63+
if: ${{ !cancelled() && github.event_name != 'pull_request' }}
6564
run: node .github/upload-preview.mjs packages/react-docs/coverage
65+
66+
- name: Upload docs artifact
67+
if: github.event_name == 'pull_request'
68+
uses: actions/upload-artifact@v4
69+
with:
70+
name: documentation
71+
path: packages/react-docs/public
72+
73+
- name: Upload a11y artifact
74+
if: github.event_name == 'pull_request'
75+
uses: actions/upload-artifact@v4
76+
with:
77+
name: a11y-coverage
78+
path: packages/react-docs/coverage

0 commit comments

Comments
 (0)