bestax/.github/workflows/test-deploy.yml at 0dd90751859fa33fe61fa6eaa571b9cede965cf0 · allxsmith/bestax · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
name: Test deployment

# Security: the build and the deploy are SEPARATE jobs, and only `deploy`
# holds the Cloudflare credentials.
#
# `build` installs and executes PR-authored code — `pnpm install`, plus every
# build-time hook the repo owns (docs/docusaurus.config.js,
# bulma-ui/.storybook/main.ts, any package.json script). Those files are NOT
# covered by the AI agents' `--disallowedTools` deny lists (which protect
# .github/**, pnpm-workspace.yaml, the jest/commitlint/release configs), so a
# claude/* PR can legitimately change code that runs here before any human
# reviews it. Keeping CLOUDFLARE_API_TOKEN out of that job means build-time
# code has no credential to reach for.
#
# `deploy` runs no repo code at all: it downloads the built site as an
# artifact and hands it to wrangler. Deliberately no checkout. Same split as
# visual-regression.yml and story-screenshots.yml.

on:
  pull_request:
    branches:
      - main

# No workflow-level grants; each job takes exactly what it needs.
permissions: {}

jobs:
  build:
    name: Build preview site
    runs-on: ubuntu-latest
    # Read-only, and no secrets: this job executes PR-authored code.
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '24'
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build Docusaurus
        run: pnpm exec turbo run build --filter=@allxsmith/bestax-docs

      - name: Build Storybook
        run: pnpm --filter @allxsmith/bestax-bulma run build-storybook

      - name: Copy Storybook to Docusaurus build
        run: |
          mkdir -p docs/build/storybook
          cp -r bulma-ui/storybook-static/* docs/build/storybook/

      # The deploy job never checks out the repo — this artifact is the only
      # thing that crosses the boundary. Fail loudly if the build produced
      # nothing rather than deploying an empty site over the preview.
      - name: Upload preview site
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: preview-site
          path: docs/build
          retention-days: 1
          if-no-files-found: error

  # Job id and display name are unchanged from the single-job version so any
  # required status check referencing "Test and Preview Deployment" still
  # resolves.
  test-deploy:
    name: Test and Preview Deployment
    runs-on: ubuntu-latest
    needs: build
    # Dependabot-triggered runs are scoped to the *Dependabot* secrets store,
    # not the Actions one, so `secrets.CLOUDFLARE_API_TOKEN` interpolates to an
    # empty string and wrangler aborts with "it's necessary to set a
    # CLOUDFLARE_API_TOKEN environment variable". That made this check red on
    # every dependency PR — noise that trains reviewers to ignore a red check.
    #
    # `github.actor` is the right condition because it is the same thing GitHub
    # keys the secret scoping on: a human pushing to a dependabot/* branch
    # becomes the actor and does get the Actions secrets, so the preview still
    # deploys in exactly the cases where it can.
    #
    # Fork PRs lose the secrets the same way, and deliberately — this workflow
    # is plain `pull_request`, so a fork head never sees them (rule 7). The
    # actor there is the contributor rather than dependabot, so the actor test
    # alone does not cover them and the head-repo guard is what does. Without
    # it a fork PR reproduces the failure this job was guarded against: the
    # deploy on an empty token, and then Comment Preview URL, whose write
    # permission GitHub downgrades to read on a fork run whatever the
    # `permissions:` block below says. Same bare idiom as claude-review.yml
    # and story-screenshots.yml; ai-scan.yml and ai-triage.yml wrap it in a
    # `pull_request == null` branch only because they also run on issues,
    # which this workflow does not. Both clauses narrow what runs — the
    # trigger above is unchanged.
    #
    # Only this job is guarded. `build` still runs on dependency PRs, so a bump
    # that breaks the Docusaurus or Storybook build is still caught.
    #
    # This reports as *skipped*, not success. Fine while the check is not
    # required (the main ruleset requires Build and Test, the React 18/19
    # matrix, and Dependency Review). If it is ever promoted to required, move
    # this condition down to the steps so the job itself still concludes green.
    #
    # Adding the Cloudflare credentials to the Dependabot secrets store would
    # also turn the check green, and is deliberately not done: it would hand a
    # live deploy token to auto-generated PRs that pull in unreviewed
    # transitive dependencies — the exact exposure the build/deploy split above
    # exists to prevent.
    if: |
      github.actor != 'dependabot[bot]' &&
      github.event.pull_request.head.repo.full_name == github.repository
    permissions:
      pull-requests: write # comment the preview URL
    steps:
      - name: Download preview site
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: preview-site
          path: docs/build

      # github.head_ref is attacker-chosen text (the PR branch name) — never
      # interpolate it into a command. Reduce it to [A-Za-z0-9-] first; the
      # sanitized output is safe to interpolate by construction and matches
      # Cloudflare's branch-alias charset.
      - name: Sanitize preview branch name
        id: branch
        env:
          HEAD_REF: ${{ github.head_ref }}
        run: |
          SAFE=$(printf '%s' "$HEAD_REF" | tr -cs 'a-zA-Z0-9-' '-' | cut -c1-63)
          echo "safe=$SAFE" >> "$GITHUB_OUTPUT"

      - name: Deploy Preview to Cloudflare Pages
        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4
        id: deploy
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: pages deploy docs/build --project-name=bestax --branch=${{ steps.branch.outputs.safe }} --commit-dirty=true

      - name: Comment Preview URL
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '## Preview Deployment\n\nPreview URL: ${{ steps.deploy.outputs.deployment-url }}'
            })