mirror of
https://github.com/mattermost/mattermost.git
synced 2026-08-27 05:37:15 -05:00
Eva SarafianouandCursor
33eb5b1a28
* ci: add docs PR preview workflows (P10) Adds preview builds for PRs touching docs/** or api/**, deployed to the existing mattermost-docs-preview-pulls S3 bucket under a repo-scoped mattermost/pr-<N>/ prefix so they don't collide with mattermost/docs's own previews of the same bucket. Fork PRs are handled via a manual workflow_dispatch since they can't access secrets; previews are cleaned up automatically on PR close for both same-repo and fork PRs. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: use PR author for docs preview TRIGGERING_ACTOR pull_request.head.user.login is the owner of the head repo/branch, not the PR author -- for same-repo PRs (head repo == base repo) this resolves to the org name instead of the contributor who opened the PR. pull_request.user.login is always the actual PR author. Co-authored-by: Cursor <cursoragent@cursor.com> * docs: reword docs preview PR comment Co-authored-by: Cursor <cursoragent@cursor.com> * fix: harden docs preview workflows - docs-preview-fork: add explicit permissions (statuses/pull-requests write, contents read) instead of relying on default token scope. - docs-preview-template: validate PR_NUMBER is digits-only and quote the S3 destination before use in the upload step, guarding against script injection via the fork dispatch's free-text input. - docs-preview-template: add a per-PR concurrency group so an older, slower build can't overwrite a newer upload. - docs-preview/docs-preview-fork: replace secrets: inherit with an explicit secrets mapping, and declare the secrets contract on the reusable template, so only the two AWS preview credentials are passed instead of every repo/org secret. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: align docs preview build/permissions with docs-ci, drop 3rd-party comment action - docs-preview-template: add Set up Go (api/server/go.mod), matching docs-ci -- make -C api build shells out to `go run .` for code sample extraction and needs a pinned toolchain, not whatever happens to be preinstalled on the runner. - docs-preview-template: drop the explicit "Build OpenAPI spec" step; npm run build's prebuild lifecycle script already runs make -C api build, so it was running twice. - docs-preview-template: replace peter-evans/create-or-update-comment with plain `gh pr comment`, dropping a third-party action pin; behavior is unchanged (posts a new comment every run). - docs-preview: add explicit permissions (contents: read, pull-requests: write) so the reusable workflow's requested pull-requests: write isn't silently downgraded by a restrictive default token policy. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: use gh pr comment in docs-preview-cleanup, drop 3rd-party action Same swap already made in docs-preview-template.yml -- gh is preinstalled on the runner, so this drops another third-party action pin. Also quotes the S3 URI via env vars for consistency with the template's upload step. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: replace pull_request_target with pull_request in docs-preview-cleanup zizmor flags pull_request_target as a dangerous trigger by default. Switch to plain pull_request, guarded to skip fork PRs (which don't get secrets on this event) -- fork preview cleanup will be handled by a separate scheduled sweep instead. Also fixes a stray '=' character that had crept into the file. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
82 lines
2.5 KiB
YAML
82 lines
2.5 KiB
YAML
name: docs-preview-fork
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
PR_NUMBER:
|
|
type: string
|
|
required: true
|
|
description: "PR number (fork PR to build preview for)"
|
|
TRIGGERING_ACTOR:
|
|
type: string
|
|
required: true
|
|
description: "GitHub login of the fork PR author"
|
|
COMMIT_SHA:
|
|
type: string
|
|
required: true
|
|
description: "Full commit SHA to build"
|
|
|
|
permissions:
|
|
contents: read
|
|
statuses: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
update-initial-status:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Set pending commit status
|
|
uses: mattermost/actions/delivery/update-commit-status@fec7b836001c9380d4bfaf28d443945c103a098c
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
with:
|
|
repository_full_name: ${{ github.repository }}
|
|
commit_sha: ${{ inputs.COMMIT_SHA }}
|
|
context: "docs-preview-fork / preview"
|
|
description: "Docs preview build for ${{ inputs.COMMIT_SHA }} is running"
|
|
status: pending
|
|
|
|
preview:
|
|
uses: ./.github/workflows/docs-preview-template.yml
|
|
secrets:
|
|
AWS_DOCS_PR_PREVIEW_KEY_ID: ${{ secrets.AWS_DOCS_PR_PREVIEW_KEY_ID }}
|
|
AWS_DOCS_PR_PREVIEW_SECRET_ACCESS_KEY: ${{ secrets.AWS_DOCS_PR_PREVIEW_SECRET_ACCESS_KEY }}
|
|
needs:
|
|
- update-initial-status
|
|
with:
|
|
PR_NUMBER: ${{ inputs.PR_NUMBER }}
|
|
TRIGGERING_ACTOR: ${{ inputs.TRIGGERING_ACTOR }}
|
|
COMMIT_SHA: ${{ inputs.COMMIT_SHA }}
|
|
|
|
update-failure-status:
|
|
runs-on: ubuntu-latest
|
|
if: failure() || cancelled()
|
|
needs:
|
|
- preview
|
|
steps:
|
|
- uses: mattermost/actions/delivery/update-commit-status@fec7b836001c9380d4bfaf28d443945c103a098c
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
with:
|
|
repository_full_name: ${{ github.repository }}
|
|
commit_sha: ${{ inputs.COMMIT_SHA }}
|
|
context: "docs-preview-fork / preview"
|
|
description: "Docs preview build for ${{ inputs.COMMIT_SHA }} failed"
|
|
status: failure
|
|
|
|
update-success-status:
|
|
runs-on: ubuntu-latest
|
|
if: success()
|
|
needs:
|
|
- preview
|
|
steps:
|
|
- uses: mattermost/actions/delivery/update-commit-status@fec7b836001c9380d4bfaf28d443945c103a098c
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
with:
|
|
repository_full_name: ${{ github.repository }}
|
|
commit_sha: ${{ inputs.COMMIT_SHA }}
|
|
context: "docs-preview-fork / preview"
|
|
description: "Docs preview build for ${{ inputs.COMMIT_SHA }} succeeded"
|
|
status: success
|