mirror of
https://github.com/mattermost/mattermost.git
synced 2026-08-27 05:37:15 -05:00
Eva SarafianouandCursor
33eb5b1a28
* ci: add docs PR preview workflows (P10) Adds preview builds for PRs touching docs/** or api/**, deployed to the existing mattermost-docs-preview-pulls S3 bucket under a repo-scoped mattermost/pr-<N>/ prefix so they don't collide with mattermost/docs's own previews of the same bucket. Fork PRs are handled via a manual workflow_dispatch since they can't access secrets; previews are cleaned up automatically on PR close for both same-repo and fork PRs. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: use PR author for docs preview TRIGGERING_ACTOR pull_request.head.user.login is the owner of the head repo/branch, not the PR author -- for same-repo PRs (head repo == base repo) this resolves to the org name instead of the contributor who opened the PR. pull_request.user.login is always the actual PR author. Co-authored-by: Cursor <cursoragent@cursor.com> * docs: reword docs preview PR comment Co-authored-by: Cursor <cursoragent@cursor.com> * fix: harden docs preview workflows - docs-preview-fork: add explicit permissions (statuses/pull-requests write, contents read) instead of relying on default token scope. - docs-preview-template: validate PR_NUMBER is digits-only and quote the S3 destination before use in the upload step, guarding against script injection via the fork dispatch's free-text input. - docs-preview-template: add a per-PR concurrency group so an older, slower build can't overwrite a newer upload. - docs-preview/docs-preview-fork: replace secrets: inherit with an explicit secrets mapping, and declare the secrets contract on the reusable template, so only the two AWS preview credentials are passed instead of every repo/org secret. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: align docs preview build/permissions with docs-ci, drop 3rd-party comment action - docs-preview-template: add Set up Go (api/server/go.mod), matching docs-ci -- make -C api build shells out to `go run .` for code sample extraction and needs a pinned toolchain, not whatever happens to be preinstalled on the runner. - docs-preview-template: drop the explicit "Build OpenAPI spec" step; npm run build's prebuild lifecycle script already runs make -C api build, so it was running twice. - docs-preview-template: replace peter-evans/create-or-update-comment with plain `gh pr comment`, dropping a third-party action pin; behavior is unchanged (posts a new comment every run). - docs-preview: add explicit permissions (contents: read, pull-requests: write) so the reusable workflow's requested pull-requests: write isn't silently downgraded by a restrictive default token policy. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: use gh pr comment in docs-preview-cleanup, drop 3rd-party action Same swap already made in docs-preview-template.yml -- gh is preinstalled on the runner, so this drops another third-party action pin. Also quotes the S3 URI via env vars for consistency with the template's upload step. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: replace pull_request_target with pull_request in docs-preview-cleanup zizmor flags pull_request_target as a dangerous trigger by default. Switch to plain pull_request, guarded to skip fork PRs (which don't get secrets on this event) -- fork preview cleanup will be handled by a separate scheduled sweep instead. Also fixes a stray '=' character that had crept into the file. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>