Current Behavior
The preview-deploy workflow has drifted from how the rest of the pipeline is built — it installs its own toolchain and builds the site directly instead of going through the standard make targets that production already uses. Additionally, it relies on checkouts of pull request head/merge refs under pull_request_target, which GitHub is deprecating for security reasons.
Desired Behavior
The preview-deploy workflow needs to be brought in line with GitHub's recommended patterns for handling pull request previews, and that change should be applied consistently across every repository subscribed to the meshery-academy topic so the workflow stays uniform wherever it's used.
Implementation
Split the workflow into a build stage that runs under pull_request using the shared make targets, handing its output to a separate privileged deploy stage via an artifact — the pattern GitHub documents for this use case. Roll the updated workflow out to all meshery-academy-subscribed repositories.
Acceptance Tests
- The workflow successfully builds the preview via
make targets.
- The workflow successfully passes the built artifacts to the deployment stage via GitHub artifacts.
- The workflow no longer relies on checking out PR refs under
pull_request_target.
Contributor Guide and Resources
Current Behavior
The
preview-deployworkflow has drifted from how the rest of the pipeline is built — it installs its own toolchain and builds the site directly instead of going through the standardmaketargets that production already uses. Additionally, it relies on checkouts of pull request head/merge refs underpull_request_target, which GitHub is deprecating for security reasons.Desired Behavior
The preview-deploy workflow needs to be brought in line with GitHub's recommended patterns for handling pull request previews, and that change should be applied consistently across every repository subscribed to the
meshery-academytopic so the workflow stays uniform wherever it's used.Implementation
Split the workflow into a build stage that runs under
pull_requestusing the sharedmaketargets, handing its output to a separate privileged deploy stage via an artifact — the pattern GitHub documents for this use case. Roll the updated workflow out to allmeshery-academy-subscribed repositories.Acceptance Tests
maketargets.pull_request_target.Contributor Guide and Resources