Skip to content

Commit af6ac77

Browse files
st0012st0012
committed
Refactor PR preview workflow for improved approval process
Because GitHub Actions' manual dispatching doesn't allow pre-filling the PR number, it'd be tedious for maintainers to manually trigger the workflow. This refactor introduces a new workflow that checks for PRs from the main repository or forks, and if it's a fork, it requires approval to deploy. This works by associating the workflow with an environment that requires approval to deploy. The pr-review-check.yml workflow will then call the cloudflare-preview.yml workflow to build and deploy the preview.
1 parent 1d26a15 commit af6ac77

File tree

3 files changed

+80
-152
lines changed

3 files changed

+80
-152
lines changed

‎.github/workflows/cloudflare-preview.yml

Lines changed: 36 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -1,129 +1,86 @@
1-
name: Cloudflare Pages Preview Deployment
1+
name: Build and Deploy Cloudflare Preview
22

33
on:
4-
# Runs automatically for PRs from ruby/rdoc
5-
# Fork PRs will be filtered out by the if condition
6-
pull_request:
7-
8-
# Allows manual triggering for fork PRs
9-
workflow_dispatch:
4+
workflow_call:
105
inputs:
11-
pull_request_number:
12-
description: 'Pull Request Number (for fork PRs)'
6+
pr_number:
7+
description: 'The pull request number'
8+
required: true
9+
type: string
10+
pr_head_sha:
11+
description: 'The SHA of the PR head commit'
1312
required: true
1413
type: string
14+
pr_checkout_repository:
15+
description: 'The repository to checkout (owner/repo)'
16+
required: true
17+
type: string
18+
secrets:
19+
cloudflare_api_token:
20+
description: 'Cloudflare API Token'
21+
required: true
22+
cloudflare_account_id:
23+
description: 'Cloudflare Account ID'
24+
required: true
25+
github_token:
26+
description: 'GitHub Token'
27+
required: true
28+
29+
permissions:
30+
pull-requests: write # To allow commenting on the PR
1531

1632
jobs:
17-
deploy-preview:
33+
build-deploy-and-comment:
34+
name: Build, Deploy, and Comment
1835
runs-on: ubuntu-latest
19-
# Skip if PR from fork and NOT manually triggered
20-
if: ${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == 'ruby/rdoc' }}
21-
2236
steps:
23-
- name: Checkout for PR from main repo
24-
if: ${{ github.event_name == 'pull_request' }}
25-
uses: actions/checkout@v4
26-
with:
27-
ref: ${{ github.event.pull_request.head.ref }}
28-
29-
# For fork PRs that are manually triggered, we need to get the PR details first
30-
- name: Get PR details for fork
31-
if: ${{ github.event_name == 'workflow_dispatch' }}
32-
id: pr_details
33-
uses: actions/github-script@v7
34-
with:
35-
script: |
36-
const prNumber = ${{ inputs.pull_request_number }};
37-
38-
// Get PR details to find the head SHA
39-
const { data: pr } = await github.rest.pulls.get({
40-
owner: context.repo.owner,
41-
repo: context.repo.repo,
42-
pull_number: prNumber
43-
});
44-
45-
console.log(`Fork PR head SHA: ${pr.head.sha}`);
46-
console.log(`Fork PR head ref: ${pr.head.ref}`);
47-
console.log(`Fork PR repo: ${pr.head.repo.full_name}`);
48-
49-
// Set outputs for checkout step
50-
core.setOutput('head_sha', pr.head.sha);
51-
core.setOutput('head_ref', pr.head.ref);
52-
core.setOutput('repo_full_name', pr.head.repo.full_name);
53-
54-
- name: Checkout for manually triggered fork PR
55-
if: ${{ github.event_name == 'workflow_dispatch' }}
37+
- name: Checkout PR Code
5638
uses: actions/checkout@v4
5739
with:
58-
ref: ${{ steps.pr_details.outputs.head_sha }}
59-
repository: ${{ steps.pr_details.outputs.repo_full_name }}
40+
repository: ${{ inputs.pr_checkout_repository }}
41+
ref: ${{ inputs.pr_head_sha }}
6042

6143
- name: Setup Ruby
6244
uses: ruby/setup-ruby@v1
6345
with:
6446
ruby-version: '3.4'
6547
bundler-cache: true
6648

67-
- name: Install dependencies
68-
run: bundle install
69-
7049
- name: Build site
7150
run: bundle exec rake rdoc
7251

73-
- name: Set PR Number
74-
id: pr_number
75-
run: |
76-
if [ "${{ github.event_name }}" == "pull_request" ]; then
77-
echo "PR_NUMBER=${{ github.event.pull_request.number }}" >> $GITHUB_ENV
78-
else
79-
echo "PR_NUMBER=${{ inputs.pull_request_number }}" >> $GITHUB_ENV
80-
fi
81-
82-
# Deploy to Cloudflare Pages using wrangler-action
8352
- name: Deploy to Cloudflare Pages
8453
id: deploy
8554
uses: cloudflare/wrangler-action@v3
8655
with:
87-
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
88-
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
89-
command: pages deploy ./_site --project-name=rdoc --branch="${{ env.PR_NUMBER }}-preview"
56+
apiToken: ${{ secrets.cloudflare_api_token }}
57+
accountId: ${{ secrets.cloudflare_account_id }}
58+
command: pages deploy ./_site --project-name=rdoc --branch="${{ inputs.pr_number }}-preview"
9059

91-
# Comment on PR with preview URL - works for both regular PRs and fork PRs
9260
- name: Comment on PR with preview URL
9361
uses: actions/github-script@v7
9462
with:
95-
github-token: ${{ secrets.MATZBOT_GITHUB_TOKEN }}
63+
github-token: ${{ secrets.github_token }}
9664
script: |
97-
const prNumber = ${{ env.PR_NUMBER }};
65+
const prNumber = ${{ inputs.pr_number }};
9866
const url = "${{ steps.deploy.outputs.deployment-url }}";
9967
const commentMarker = "🚀 Preview deployment available at:";
68+
const commitSha = '${{ inputs.pr_head_sha }}';
10069
101-
// Get commit SHA based on event type
102-
let commitSha;
103-
if ('${{ github.event_name }}' === 'pull_request') {
104-
commitSha = '${{ github.event.pull_request.head.sha }}';
105-
} else {
106-
// For workflow_dispatch, get the SHA from the PR details
107-
commitSha = '${{ steps.pr_details.outputs.head_sha }}';
108-
}
109-
110-
// Get all comments on the PR
11170
const comments = await github.rest.issues.listComments({
11271
issue_number: prNumber,
11372
owner: context.repo.owner,
11473
repo: context.repo.repo,
11574
per_page: 100
11675
});
11776
118-
// Look for our previous bot comment
11977
const existingComment = comments.data.find(comment =>
12078
comment.body.includes(commentMarker)
12179
);
12280
12381
const commentBody = `${commentMarker} [${url}](${url}) (commit: ${commitSha})`;
12482
12583
if (existingComment) {
126-
// Update existing comment
12784
await github.rest.issues.updateComment({
12885
comment_id: existingComment.id,
12986
owner: context.repo.owner,
@@ -132,7 +89,6 @@ jobs:
13289
});
13390
console.log("Updated existing preview comment");
13491
} else {
135-
// Create new comment
13692
await github.rest.issues.createComment({
13793
issue_number: prNumber,
13894
owner: context.repo.owner,

‎.github/workflows/pr-preview-check.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: PR Preview Check and Trigger
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
# For PRs from the main repo - direct call to the shared workflow
8+
trigger-main-repo-preview:
9+
name: Trigger Preview (Main Repo)
10+
uses: ./.github/workflows/cloudflare-preview.yml
11+
if: github.event.pull_request.head.repo.fork == false
12+
with:
13+
pr_number: ${{ github.event.pull_request.number }}
14+
pr_head_sha: ${{ github.event.pull_request.head.sha }}
15+
pr_checkout_repository: ${{ github.repository }}
16+
secrets:
17+
cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
18+
cloudflare_account_id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
19+
github_token: ${{ secrets.MATZBOT_GITHUB_TOKEN }}
20+
21+
# For fork PRs - this job requires approval
22+
wait-for-approval:
23+
name: Wait for Approval (Fork PR)
24+
runs-on: ubuntu-latest
25+
if: github.event.pull_request.head.repo.fork == true
26+
environment: fork-preview-protection
27+
# This job only serves as an approval gate - it doesn't do anything else
28+
steps:
29+
- run: echo "Approval granted. Proceeding with preview deployment for commit ${{ github.event.pull_request.head.sha }}."
30+
31+
# Once approval is granted, call the shared workflow
32+
trigger-fork-preview:
33+
name: Trigger Preview (Fork - After Approval)
34+
needs: wait-for-approval
35+
uses: ./.github/workflows/cloudflare-preview.yml
36+
if: github.event.pull_request.head.repo.fork == true
37+
with:
38+
pr_number: ${{ github.event.pull_request.number }}
39+
pr_head_sha: ${{ github.event.pull_request.head.sha }}
40+
pr_checkout_repository: ${{ github.event.pull_request.head.repo.full_name }}
41+
secrets:
42+
cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
43+
cloudflare_account_id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
44+
github_token: ${{ secrets.MATZBOT_GITHUB_TOKEN }}

‎.github/workflows/pr-preview-comment.yml

Lines changed: 0 additions & 72 deletions
This file was deleted.

0 commit comments

Comments
 (0)