Skip to content

Commit b1c02db

Browse files
st0012st0012
committed
Refactor PR preview workflow for improved approval process
Because GitHub Actions' manual dispatching doesn't allow pre-filling the PR number, it'd be tedious for maintainers to manually trigger the workflow. This refactor introduces a new workflow that checks for PRs from the main repository or forks, and if it's a fork, it requires approval to deploy. This works by associating the workflow with an environment that requires approval to deploy. The pr-review-check.yml workflow will then call the cloudflare-preview.yml workflow to build and deploy the preview.
1 parent 103a6a1 commit b1c02db

File tree

3 files changed

+76
-151
lines changed

3 files changed

+76
-151
lines changed

‎.github/workflows/cloudflare-preview.yml

Lines changed: 34 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -1,128 +1,84 @@
1-
name: Cloudflare Pages Preview Deployment
1+
name: Build and Deploy Cloudflare Preview
22

33
on:
4-
# Runs automatically for PRs from ruby/rdoc
5-
# Fork PRs will be filtered out by the if condition
6-
pull_request:
7-
8-
# Allows manual triggering for fork PRs
9-
workflow_dispatch:
4+
workflow_call:
105
inputs:
11-
pull_request_number:
12-
description: 'Pull Request Number (for fork PRs)'
6+
pr_number:
7+
description: 'The pull request number'
8+
required: true
9+
type: string
10+
pr_head_sha:
11+
description: 'The SHA of the PR head commit'
12+
required: true
13+
type: string
14+
pr_checkout_repository:
15+
description: 'The repository to checkout (owner/repo)'
16+
required: true
17+
type: string
18+
# Reusable workflow doesn't have directly access to secrets, so we need to pass them in as inputs
19+
cloudflare_api_token:
20+
description: 'Cloudflare API Token'
1321
required: true
1422
type: string
23+
cloudflare_account_id:
24+
description: 'Cloudflare Account ID'
25+
required: true
26+
type: string
27+
28+
permissions:
29+
pull-requests: write # To allow commenting on the PR
1530

1631
jobs:
17-
deploy-preview:
32+
build-deploy-and-comment:
33+
name: Build, Deploy, and Comment
1834
runs-on: ubuntu-latest
19-
# Skip if PR from fork and NOT manually triggered
20-
if: ${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == 'ruby/rdoc' }}
21-
2235
steps:
23-
- name: Checkout for PR from main repo
24-
if: ${{ github.event_name == 'pull_request' }}
36+
- name: Checkout PR Code
2537
uses: actions/checkout@v4
2638
with:
27-
ref: ${{ github.event.pull_request.head.ref }}
28-
29-
# For fork PRs that are manually triggered, we need to get the PR details first
30-
- name: Get PR details for fork
31-
if: ${{ github.event_name == 'workflow_dispatch' }}
32-
id: pr_details
33-
uses: actions/github-script@v7
34-
with:
35-
script: |
36-
const prNumber = ${{ inputs.pull_request_number }};
37-
38-
// Get PR details to find the head SHA
39-
const { data: pr } = await github.rest.pulls.get({
40-
owner: context.repo.owner,
41-
repo: context.repo.repo,
42-
pull_number: prNumber
43-
});
44-
45-
console.log(`Fork PR head SHA: ${pr.head.sha}`);
46-
console.log(`Fork PR head ref: ${pr.head.ref}`);
47-
console.log(`Fork PR repo: ${pr.head.repo.full_name}`);
48-
49-
// Set outputs for checkout step
50-
core.setOutput('head_sha', pr.head.sha);
51-
core.setOutput('head_ref', pr.head.ref);
52-
core.setOutput('repo_full_name', pr.head.repo.full_name);
53-
54-
- name: Checkout for manually triggered fork PR
55-
if: ${{ github.event_name == 'workflow_dispatch' }}
56-
uses: actions/checkout@v4
57-
with:
58-
ref: ${{ steps.pr_details.outputs.head_sha }}
59-
repository: ${{ steps.pr_details.outputs.repo_full_name }}
39+
repository: ${{ inputs.pr_checkout_repository }}
40+
ref: ${{ inputs.pr_head_sha }}
6041

6142
- name: Setup Ruby
6243
uses: ruby/setup-ruby@v1
6344
with:
6445
ruby-version: '3.4'
6546
bundler-cache: true
6647

67-
- name: Install dependencies
68-
run: bundle install
69-
7048
- name: Build site
7149
run: bundle exec rake rdoc
7250

73-
- name: Set PR Number
74-
id: pr_number
75-
run: |
76-
if [ "${{ github.event_name }}" == "pull_request" ]; then
77-
echo "PR_NUMBER=${{ github.event.pull_request.number }}" >> $GITHUB_ENV
78-
else
79-
echo "PR_NUMBER=${{ inputs.pull_request_number }}" >> $GITHUB_ENV
80-
fi
81-
82-
# Deploy to Cloudflare Pages using wrangler-action
8351
- name: Deploy to Cloudflare Pages
8452
id: deploy
8553
uses: cloudflare/wrangler-action@v3
8654
with:
87-
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
88-
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
89-
command: pages deploy ./_site --project-name=rdoc --branch="${{ env.PR_NUMBER }}-preview"
55+
apiToken: ${{ inputs.cloudflare_api_token }}
56+
accountId: ${{ inputs.cloudflare_account_id }}
57+
command: pages deploy ./_site --project-name=rdoc --branch="${{ inputs.pr_number }}-preview"
9058

91-
# Comment on PR with preview URL - works for both regular PRs and fork PRs
9259
- name: Comment on PR with preview URL
9360
uses: actions/github-script@v7
9461
with:
9562
script: |
96-
const prNumber = ${{ env.PR_NUMBER }};
63+
const prNumber = ${{ inputs.pr_number }};
9764
const url = "${{ steps.deploy.outputs.deployment-url }}";
9865
const commentMarker = "🚀 Preview deployment available at:";
66+
const commitSha = '${{ inputs.pr_head_sha }}';
9967
100-
// Get commit SHA based on event type
101-
let commitSha;
102-
if ('${{ github.event_name }}' === 'pull_request') {
103-
commitSha = '${{ github.event.pull_request.head.sha }}';
104-
} else {
105-
// For workflow_dispatch, get the SHA from the PR details
106-
commitSha = '${{ steps.pr_details.outputs.head_sha }}';
107-
}
108-
109-
// Get all comments on the PR
11068
const comments = await github.rest.issues.listComments({
11169
issue_number: prNumber,
11270
owner: context.repo.owner,
11371
repo: context.repo.repo,
11472
per_page: 100
11573
});
11674
117-
// Look for our previous bot comment
11875
const existingComment = comments.data.find(comment =>
11976
comment.body.includes(commentMarker)
12077
);
12178
12279
const commentBody = `${commentMarker} [${url}](${url}) (commit: ${commitSha})`;
12380
12481
if (existingComment) {
125-
// Update existing comment
12682
await github.rest.issues.updateComment({
12783
comment_id: existingComment.id,
12884
owner: context.repo.owner,
@@ -131,7 +87,6 @@ jobs:
13187
});
13288
console.log("Updated existing preview comment");
13389
} else {
134-
// Create new comment
13590
await github.rest.issues.createComment({
13691
issue_number: prNumber,
13792
owner: context.repo.owner,

‎.github/workflows/pr-preview-check.yml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: PR Preview Check and Trigger
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
# For PRs from the main repo - direct call to the shared workflow
8+
trigger-main-repo-preview:
9+
name: Trigger Preview (Main Repo)
10+
uses: ./.github/workflows/cloudflare-preview.yml
11+
if: github.event.pull_request.head.repo.fork == false
12+
with:
13+
pr_number: ${{ github.event.pull_request.number }}
14+
pr_head_sha: ${{ github.event.pull_request.head.sha }}
15+
pr_checkout_repository: ${{ github.repository }}
16+
secrets:
17+
cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
18+
cloudflare_account_id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
19+
20+
# For fork PRs - this job requires approval
21+
wait-for-approval:
22+
name: Wait for Approval (Fork PR)
23+
runs-on: ubuntu-latest
24+
if: github.event.pull_request.head.repo.fork == true
25+
environment: fork-preview-protection
26+
# This job only serves as an approval gate - it doesn't do anything else
27+
steps:
28+
- run: echo "Approval granted. Proceeding with preview deployment for commit ${{ github.event.pull_request.head.sha }}."
29+
30+
# Once approval is granted, call the shared workflow
31+
trigger-fork-preview:
32+
name: Trigger Preview (Fork - After Approval)
33+
needs: wait-for-approval
34+
uses: ./.github/workflows/cloudflare-preview.yml
35+
if: github.event.pull_request.head.repo.fork == true
36+
with:
37+
pr_number: ${{ github.event.pull_request.number }}
38+
pr_head_sha: ${{ github.event.pull_request.head.sha }}
39+
pr_checkout_repository: ${{ github.event.pull_request.head.repo.full_name }}
40+
secrets:
41+
cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN_FOR_FORKS }}
42+
cloudflare_account_id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID_FOR_FORKS }}

‎.github/workflows/pr-preview-comment.yml

Lines changed: 0 additions & 72 deletions
This file was deleted.

0 commit comments

Comments
 (0)