-
Notifications
You must be signed in to change notification settings - Fork 8
Preview Update 31st July #398
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,153 @@ | ||
| name: PR Preview Deploy | ||
|
|
||
| on: | ||
| workflow_run: | ||
| workflows: ["PR Preview"] | ||
| types: [completed] | ||
|
|
||
| # Write permissions are safe here — this workflow always runs from the base | ||
| # repository context (main branch), never from fork code. | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
|
|
||
| # Serialize all gh-pages pushes to prevent non-fast-forward failures | ||
| # when two PRs deploy at the same time. | ||
| concurrency: | ||
| group: gh-pages-deploy | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| deploy: | ||
| name: Deploy Preview | ||
| runs-on: ubuntu-latest | ||
| if: github.event.workflow_run.conclusion == 'success' | ||
|
|
||
| steps: | ||
| - name: Download preview artifact | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: pr-preview-site | ||
| path: /tmp/pr-preview-site | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| run-id: ${{ github.event.workflow_run.id }} | ||
|
|
||
| - name: Read PR number from artifact | ||
| id: pr | ||
| run: | | ||
| PR_NUMBER=$(cat /tmp/pr-preview-site/.pr-number) | ||
| echo "number=${PR_NUMBER}" >> "$GITHUB_OUTPUT" | ||
| rm /tmp/pr-preview-site/.pr-number | ||
|
|
||
| - name: Get PR head SHA | ||
| id: sha | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| const pr = await github.rest.pulls.get({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| pull_number: ${{ steps.pr.outputs.number }}, | ||
| }); | ||
| core.setOutput('sha', pr.data.head.sha.substring(0, 7)); | ||
|
|
||
| - name: Checkout repo | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| persist-credentials: true | ||
|
|
||
| - name: Checkout or initialise gh-pages branch | ||
| run: | | ||
| git fetch origin gh-pages 2>/dev/null || true | ||
| if git show-ref --verify --quiet refs/remotes/origin/gh-pages; then | ||
| git checkout -B gh-pages origin/gh-pages | ||
| else | ||
| git checkout --orphan gh-pages | ||
| git rm -rf . --quiet | ||
| echo "GitHub Pages for mta-documentation" > README.md | ||
| git add README.md | ||
| git -c user.name="github-actions[bot]" -c user.email="github-actions[bot]@users.noreply.github.com" commit -m "chore: initialise gh-pages branch" | ||
| git push origin gh-pages | ||
| fi | ||
|
|
||
| - name: Configure git | ||
| run: | | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "github-actions[bot]@users.noreply.github.com" | ||
|
|
||
| - name: Deploy preview to gh-pages | ||
| env: | ||
| PR_NUMBER: ${{ steps.pr.outputs.number }} | ||
| COMMIT_SHA: ${{ steps.sha.outputs.sha }} | ||
| run: | | ||
| PREVIEW_DIR="pr-previews/${PR_NUMBER}" | ||
| rm -rf "${PREVIEW_DIR}" | ||
| mkdir -p "${PREVIEW_DIR}" | ||
| cp -r /tmp/pr-preview-site/. "${PREVIEW_DIR}/" | ||
|
|
||
| git add "${PREVIEW_DIR}" | ||
| if git diff --staged --quiet; then | ||
| echo "No changes to deploy." | ||
| else | ||
| git commit -m "preview: PR #${PR_NUMBER} @ ${COMMIT_SHA}" | ||
| for attempt in 1 2 3; do | ||
| git fetch origin gh-pages | ||
| if git rebase origin/gh-pages; then | ||
| git push origin gh-pages && break | ||
| else | ||
| git rebase --abort | ||
| fi | ||
| echo "Push attempt ${attempt} failed, retrying..." | ||
| sleep $((attempt * 5)) | ||
| done | ||
| fi | ||
|
|
||
| - name: Post or update preview comment | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| const prNumber = ${{ steps.pr.outputs.number }}; | ||
| const sha = '${{ steps.sha.outputs.sha }}'; | ||
| const owner = context.repo.owner; | ||
| const repo = context.repo.repo; | ||
|
|
||
| const previewUrl = | ||
| `https://${owner}.github.io/${repo}/pr-previews/${prNumber}/`; | ||
|
|
||
| const body = [ | ||
| `## 📄 Documentation Preview`, | ||
| ``, | ||
| `| | |`, | ||
| `|---|---|`, | ||
| `| **Preview URL** | ${previewUrl} |`, | ||
| `| **Commit** | \`${sha}\` |`, | ||
| `| **Updated** | ${new Date().toUTCString()} |`, | ||
| ``, | ||
| `> Preview updates automatically on every push to this PR.`, | ||
| `> It will be removed when the PR is closed.`, | ||
| ].join('\n'); | ||
|
|
||
| const marker = '<!-- pr-preview-bot -->'; | ||
| const markedBody = marker + '\n' + body; | ||
|
|
||
| const comments = await github.paginate(github.rest.issues.listComments, { | ||
| owner, repo, issue_number: prNumber, | ||
| }); | ||
|
|
||
| const existing = comments.find(c => c.body.includes(marker)); | ||
| if (existing) { | ||
| await github.rest.issues.updateComment({ | ||
| owner, repo, | ||
| comment_id: existing.id, | ||
| body: markedBody, | ||
| }); | ||
| } else { | ||
| await github.rest.issues.createComment({ | ||
| owner, repo, | ||
| issue_number: prNumber, | ||
| body: markedBody, | ||
| }); | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Does actions/download-artifact v4 require actions:read permission to download an artifact from a different workflow run via run-id in the same repository?💡 Result:
Yes, when using actions/download-artifact@v4 to download an artifact from a different workflow run (even within the same repository), you must provide a github-token with the appropriate permissions [1][2][3]. By default, the actions/download-artifact action is scoped to the current workflow run [1][4]. To access artifacts from a different run, you must specify the github-token input [2][3]. This token must have at least actions:read permissions for the target repository to successfully authenticate the request via the GitHub API [5][6]. While the default GITHUB_TOKEN provided in a standard workflow environment is typically scoped to the current repository and workflow, it may lack the necessary permissions to access artifacts from other workflow runs unless specifically configured or replaced with a token (such as a Personal Access Token or a scoped installation token) that possesses the required actions:read access [5]. If the provided token lacks these permissions, the action will fail during the API call [5].
Citations:
🏁 Script executed:
Repository: migtools/mta-documentation
Length of output: 2805
Add
actions: readpermission for cross-run artifact download.actions/download-artifact@v4uses the providedgithub-tokento fetch artifacts from another run viarun-id. Since this workflow declares an explicit permission block withoutactions: read, the deploy job cannot authenticate that artifact request and the preview deployment fails.🔧 Proposed fix
permissions: contents: write pull-requests: write + actions: readApplies to lines: 10-12 and 27-33.
📝 Committable suggestion
🤖 Prompt for AI Agents