preview_site_trigger.yml

name: Call Build Preview
on:
  pull_request:
    types: [opened, reopened, synchronize]

# Restrictive default permissions
permissions:
  contents: read # Required for repository context

jobs:
  approval_check:
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read # Required for repository context
      actions: write # Required to upload artifacts that trigger the preview build workflow
    # Only run for PRs with 'website' in the branch name
    if: ${{ contains(github.head_ref, 'website') }}
    steps:
      # Validate branch name
      - name: Validate branch name and set output
        id: validate
        env:
          BRANCH: ${{ github.head_ref }}
        run: |
          if [[ ! "$BRANCH" =~ ^[a-zA-Z0-9_-]+$ ]]; then
            echo "valid=false" >> $GITHUB_OUTPUT
          else
            echo "valid=true" >> $GITHUB_OUTPUT
          fi

      # Save PR information (only if branch is valid)
      - name: Validate and save PR information
        if: steps.validate.outputs.valid == 'true'
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const fs = require('fs').promises;
            const path = require('path');
            const crypto = require('crypto');
            const prNumber = context.payload.number;
            const branchName = context.payload.pull_request.head.ref;

            await fs.mkdir('./pr', { recursive: true });
            await fs.writeFile('./pr/number', prNumber.toString());
            await fs.writeFile('./pr/branch', branchName);

            const numberHash = crypto.createHash('sha256').update(prNumber.toString()).digest('hex');
            const branchHash = crypto.createHash('sha256').update(branchName).digest('hex');
            await fs.writeFile('./pr/integrity', `${numberHash}:${branchHash}`);

            core.info(`Saved PR #${prNumber} and branch ${branchName}`);

      # Upload the artifact using latest version (only if branch is valid)
      - name: Upload PR information artifact
        if: steps.validate.outputs.valid == 'true'
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: pr
          path: pr/
          retention-days: 1