pr-preview-deploy.yml

name: PR preview deploy

# Stage 2 of 2: PUBLISH ONLY. Holds the deploy secrets; runs no contributor code.
#
# Triggered by `workflow_run` on .github/workflows/pr-preview.yml, which builds
# the site from the PR's tree with no secrets in scope. Because `workflow_run`
# always executes the workflow definition from the DEFAULT BRANCH, a pull
# request cannot alter what this file does, and repository secrets are
# available even when the PR came from a fork -- which is the entire reason the
# preview is split in two.
#
# The invariant that makes that safe: this job must never execute anything from
# the pull request. It downloads an artifact and copies files. Specifically:
#
#   * The GitHub Pages job checks out the default branch. It must never be
#     given `ref: ...head.sha` or anything else derived from the PR.
#   * The Cloudflare job does not check out any repository.
#   * No `npm ci`, no build, no `npm run`, no running a script out of `site/`.
#     The artifact is inert data here -- static files pushed to a host.
#   * Nothing from the artifact may be interpolated into a `run:` block.
#
# GitHub Pages and Cloudflare deploy in separate jobs. They share only the PR
# resolution job, so a failure in either host cannot block the other.
#
# The PR number is NOT taken from the artifact, which a fork controls and could
# use to overwrite an unrelated PR's preview and comment on it. It is looked up
# from the API using the head repo and branch recorded in the trusted
# `workflow_run` payload, so a run can only ever address its own PR.
#
# Required repository secrets:
#   CLOUDFLARE_API_TOKEN   - needs the "Cloudflare Pages: Edit" permission
#   CLOUDFLARE_ACCOUNT_ID
#   PREVIEW_DEPLOY_TOKEN   - fine-grained PAT scoped to opengeos/pages-preview
#                            only, with Contents: Read and write + Pages: Read.
#                            Pages read is required by wait-for-pages-deployment
#                            below; without it the poll never sees a build and
#                            the job times out with a misleading error.

on:
  workflow_run:
    workflows: ["PR preview"]
    types: [completed]

permissions:
  contents: read
  # Download the build artifact from the triggering run.
  actions: read
  # Update the sticky preview comments. The deploy to opengeos/pages-preview
  # uses PREVIEW_DEPLOY_TOKEN, which has no access to this repository.
  pull-requests: write

concurrency:
  group: pr-preview-deploy-${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}
  # The GitHub Pages job pushes commits to opengeos/pages-preview. Queue
  # overlapping runs instead of killing one mid-push.
  cancel-in-progress: false

jobs:
  resolve:
    name: Resolve pull request
    runs-on: ubuntu-latest
    # Only for builds that came from a pull request and actually succeeded. A
    # `workflow_dispatch` build of pr-preview.yml is a build smoke test and
    # publishes nothing, matching the behaviour before the split.
    if: >-
      github.event.workflow_run.event == 'pull_request' &&
      github.event.workflow_run.conclusion == 'success'
    outputs:
      found: ${{ steps.pr.outputs.found }}
      number: ${{ steps.pr.outputs.number }}
      action: ${{ steps.pr.outputs.action }}
    steps:
      # Resolve the PR from trusted event data only. `workflow_run.pull_requests`
      # is empty for fork PRs, so query by head instead: the (fork, branch) pair
      # is recorded by GitHub, not by the build, and an attacker cannot push to
      # someone else's fork -- so this can only resolve to the PR that triggered
      # the run.
      - name: Resolve the pull request
        id: pr
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
        run: |
          set -euo pipefail
          # Highest number wins if a branch has been reused across PRs; that is
          # the current one.
          # No --paginate: the head filter cannot return anywhere near 100 PRs,
          # and per-page --jq would mangle the max_by below.
          #
          # `// empty` matters: max_by on an empty array yields null, and piping
          # null into the object constructor would produce {"number":null} --
          # a truthy string that sails past the emptiness check below.
          pr=$(gh api \
            "repos/${REPO}/pulls?state=all&per_page=100&head=${HEAD_OWNER}:${HEAD_BRANCH}" \
            --jq 'max_by(.number) // empty | {number, state}' || true)
          if [ -z "$pr" ]; then
            echo "::notice::No pull request found for ${HEAD_OWNER}:${HEAD_BRANCH} -- nothing to publish."
            echo "found=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          number=$(echo "$pr" | jq -r .number)
          state=$(echo "$pr" | jq -r .state)
          case "$number" in
            ''|*[!0-9]*) echo "::error::Unexpected PR number: $number"; exit 1 ;;
          esac
          echo "PR #${number} is ${state}"
          echo "found=true" >> "$GITHUB_OUTPUT"
          echo "number=${number}" >> "$GITHUB_OUTPUT"
          # Drive deploy-vs-remove off the PR's live state rather than off the
          # build job, so a preview is never published for a closed PR.
          if [ "$state" = "closed" ]; then
            echo "action=remove" >> "$GITHUB_OUTPUT"
          else
            echo "action=deploy" >> "$GITHUB_OUTPUT"
          fi

  cloudflare:
    name: Deploy Cloudflare preview
    needs: resolve
    if: >-
      needs.resolve.outputs.found == 'true' &&
      needs.resolve.outputs.action == 'deploy'
    runs-on: ubuntu-latest
    steps:
      - name: Download the built site
        uses: actions/download-artifact@v8
        with:
          name: pr-preview-site
          path: site
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ github.token }}

      - name: Drop the CDN-redirected DuckDB WASM
        # Cloudflare Pages rejects any single file > 25 MiB. Stage 1 already
        # wrote site/_redirects pointing every such file at jsDelivr and failed
        # the build on any it could not map, so deleting by size alone here is
        # safe: anything left over 25 MiB is already redirected.
        run: |
          set -euo pipefail
          find site -type f -size +26214400c -printf 'dropping %p (%s bytes)\n' -delete
          echo "----- site/_redirects -----"
          cat site/_redirects || echo "(none)"

      - name: Create a scratch directory for wrangler
        run: mkdir -p .wrangler-deploy

      - name: Deploy to Cloudflare Pages
        id: deploy
        uses: cloudflare/wrangler-action@v4
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          # wrangler-action installs wrangler with npm into its working
          # directory. Point it at an empty scratch dir so it does not resolve
          # against this monorepo's package.json / workspaces, and give the
          # payload an absolute path.
          workingDirectory: .wrangler-deploy
          # A PR-number branch gives every PR an isolated preview and avoids
          # collisions when forks use the same source branch name.
          command: >-
            pages deploy ${{ github.workspace }}/site
            --project-name=geolibre-preview
            --branch="pr-${{ needs.resolve.outputs.number }}"
            --commit-hash="${{ github.event.workflow_run.head_sha }}"
            --commit-dirty=true

      - name: Comment preview URL on PR
        uses: actions/github-script@v9
        env:
          DEPLOY_URL: ${{ steps.deploy.outputs.deployment-url }}
          PR_NUMBER: ${{ needs.resolve.outputs.number }}
          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
        with:
          script: |
            const url = process.env.DEPLOY_URL;
            if (!url) return;
            const marker = '<!-- cloudflare-preview -->';
            const body = `${marker}\n### 🔍 Cloudflare PR preview\n\n| Item | Value |\n| --- | --- |\n| Site | ${url} |\n| Demo app | ${url}/demo/ |\n| Commit | \`${process.env.HEAD_SHA.slice(0, 7)}\` |`;
            const { owner, repo } = context.repo;
            const issue_number = Number(process.env.PR_NUMBER);
            const { data: comments } = await github.rest.issues.listComments({ owner, repo, issue_number, per_page: 100 });
            const existing = comments.find((c) => c.body && c.body.includes(marker));
            if (existing) {
              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
            } else {
              await github.rest.issues.createComment({ owner, repo, issue_number, body });
            }

  github-pages:
    name: Deploy GitHub Pages preview
    needs: resolve
    if: needs.resolve.outputs.found == 'true'
    runs-on: ubuntu-latest
    steps:
      # The Pages deploy action needs a git repository in the workspace. This
      # is the DEFAULT BRANCH -- never the PR head. Do not add a `ref:` here.
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Download the built site
        if: needs.resolve.outputs.action == 'deploy'
        uses: actions/download-artifact@v8
        with:
          name: pr-preview-site
          path: site
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ github.token }}

      - name: Deploy preview to GitHub Pages
        id: pages
        # Pinned rather than tracking the v1 tag: this is a third-party action
        # and it receives PREVIEW_DEPLOY_TOKEN.
        uses: rossjrw/pr-preview-action@ffa7509e91a3ec8dfc2e5536c4d5c1acdf7a6de9 # v1.8.1
        with:
          source-dir: site
          deploy-repository: opengeos/pages-preview
          token: ${{ secrets.PREVIEW_DEPLOY_TOKEN }}
          pages-base-url: opengeos.org/pages-preview
          preview-branch: gh-pages
          # pages-preview is shared across opengeos repositories and the action
          # composes the path as "<umbrella-dir>/pr-<number>", so this namespaces
          # our previews against every other repository's.
          umbrella-dir: GeoLibre
          # There is no pull_request payload under `workflow_run`, so the PR
          # number and the deploy/remove decision have to be passed explicitly;
          # the action would otherwise read them off the event and do nothing.
          pr-number: ${{ needs.resolve.outputs.number }}
          action: ${{ needs.resolve.outputs.action }}
          # Same reason: the default messages interpolate `github.event.number`,
          # which is empty here.
          deploy-commit-message: Deploy preview for PR ${{ needs.resolve.outputs.number }} 🛫
          remove-commit-message: Remove preview for PR ${{ needs.resolve.outputs.number }} 🛬
          wait-for-pages-deployment: true
          comment: false

      - name: Comment GitHub Pages preview status
        if: always() && needs.resolve.outputs.action == 'deploy'
        uses: actions/github-script@v9
        env:
          PAGES_URL: ${{ steps.pages.outputs.preview-url }}
          PAGES_OUTCOME: ${{ steps.pages.outcome }}
          PR_NUMBER: ${{ needs.resolve.outputs.number }}
          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
        with:
          script: |
            const pagesUrl = process.env.PAGES_URL;
            const succeeded = process.env.PAGES_OUTCOME === 'success' && pagesUrl;
            const marker = '<!-- github-pages-preview -->';
            const site = succeeded ? pagesUrl : 'Deploy failed. See the job log.';
            const demo = succeeded
              ? `${pagesUrl}${pagesUrl.endsWith('/') ? '' : '/'}demo/`
              : 'Unavailable';
            const body = `${marker}\n### 🔍 GitHub Pages PR preview\n\n| Item | Value |\n| --- | --- |\n| Site | ${site} |\n| Demo app | ${demo} |\n| Commit | \`${process.env.HEAD_SHA.slice(0, 7)}\` |`;
            const { owner, repo } = context.repo;
            const issue_number = Number(process.env.PR_NUMBER);
            const { data: comments } = await github.rest.issues.listComments({ owner, repo, issue_number, per_page: 100 });
            const existing = comments.find((c) => c.body && c.body.includes(marker));
            if (existing) {
              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
            } else {
              await github.rest.issues.createComment({ owner, repo, issue_number, body });
            }