fix: update preview workflow - #171
banana-three-join merged 1 commit into
Conversation
Signed-off-by: Lenox Wiltshire <lenoxwiltshire@gmail.com>
📝 WalkthroughWalkthroughThe previous preview workflow was removed. Separate workflows now build documentation previews, upload build metadata, deploy or remove previews, prune older previews, and update pull-request comments. ChangesDocumentation Preview Delivery
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant BuildDocsPreview
participant ArtifactStorage
participant DeployDocsPreview
participant GitHubPages
PullRequest->>BuildDocsPreview: trigger preview build
BuildDocsPreview->>ArtifactStorage: upload preview and PR metadata
ArtifactStorage->>DeployDocsPreview: provide artifacts
DeployDocsPreview->>GitHubPages: deploy or remove preview
DeployDocsPreview->>PullRequest: update preview comment
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-docs-preview.yml:
- Line 26: Update the workflow so metadata creation and upload of the pr/action
artifact run for closed pull requests as well, using an always-running job. Keep
dependency installation and npm run build:preview conditional on
github.event.action != 'closed', while preserving the existing preview-removal
flow’s access to the uploaded artifact.
In @.github/workflows/deploy-docs-preview.yml:
- Around line 101-104: Update the prune job’s needs declaration so it depends on
both read-metadata and deploy, while preserving its existing runs-on and action
condition. This ensures pruning runs only after deployment completes.
- Around line 8-11: Remove the workflow-level contents: write and pull-requests:
write permissions, leaving only actions: read globally. Add contents: write and
pull-requests: write under the permissions for the deploy and prune jobs, while
keeping read-metadata limited to actions: read.
- Around line 33-39: Replace the mutable action tags with full commit-SHA
references in .github/workflows/deploy-docs-preview.yml: pin both
actions/download-artifact uses at lines 33-39 and 70-76, actions/checkout at
lines 109-116, and actions/github-script at lines 203-208. Preserve each
action’s existing version and configuration while ensuring all four references
resolve to immutable commits.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 23522f73-051a-4920-a65b-262fac1375bf
📒 Files selected for processing (3)
.github/workflows/build-and-preview-site.yml.github/workflows/build-docs-preview.yml.github/workflows/deploy-docs-preview.yml
💤 Files with no reviewable changes (1)
- .github/workflows/build-and-preview-site.yml
| jobs: | ||
| build-docs-preview: | ||
| runs-on: ubuntu-24.04 | ||
| if: github.event.action != 'closed' |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Preserve metadata for closed pull requests.
Line 26 skips the only job that writes and uploads pr/action. A closed event then has no docs-preview-build artifact. .github/workflows/deploy-docs-preview.yml cannot read the action or run the preview removal flow.
Move metadata creation and artifact upload to an always-running job. Run dependency installation and npm run build:preview only when the action is not closed.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-docs-preview.yml at line 26, Update the workflow so
metadata creation and upload of the pr/action artifact run for closed pull
requests as well, using an always-running job. Keep dependency installation and
npm run build:preview conditional on github.event.action != 'closed', while
preserving the existing preview-removal flow’s access to the uploaded artifact.
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| actions: read |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Scope write permissions to the jobs that require them.
read-metadata downloads and parses a pull-request artifact, but it only requires actions: read. Move contents: write and pull-requests: write to the deploy and prune jobs. This reduces the privileged workflow_run attack surface.
🧰 Tools
🪛 zizmor (1.28.0)
[error] 9-9: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[error] 10-10: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-docs-preview.yml around lines 8 - 11, Remove the
workflow-level contents: write and pull-requests: write permissions, leaving
only actions: read globally. Add contents: write and pull-requests: write under
the permissions for the deploy and prune jobs, while keeping read-metadata
limited to actions: read.
Source: Linters/SAST tools
| - name: Download build artifact | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: docs-preview-build | ||
| path: docs-preview-build | ||
| run-id: ${{ github.event.workflow_run.id }} | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for ref in \
actions/download-artifact@v4 \
actions/checkout@v6 \
actions/github-script@v8
do
repo="${ref%@*}"
tag="${ref#*@}"
sha="$(gh api "repos/${repo}/commits/${tag}" --jq .sha)"
printf '%s@%s # %s\n' "$repo" "$sha" "$tag"
doneRepository: layer5io/academy-example
Length of output: 365
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf 'Workflow action references in deploy-docs-preview.yml:\n'
rg -n 'uses:\s*[^#\s]+@[^\s]+' .github/workflows/deploy-docs-preview.yml || true
printf '\nResolved full SHA for referenced tags:\n'
python3 - <<'PY'
import re
from subprocess import run, PIPE
path = '.github/workflows/deploy-docs-preview.yml'
text = open(path).read()
refs = re.findall(r'uses:\s*([^#\s]+)', text)
for ref in refs:
repo, tag = ref.rsplit('@', 1)
result = run(['gh', 'api', f'repos/{repo}/commits/{tag}'], text=True, capture_output=True)
sha = None
if result.returncode == 0:
import json
sha = json.loads(result.stdout)['sha']
print(f'{path}: uses={ref} -> sha={sha!r}')
PYRepository: layer5io/academy-example
Length of output: 2231
Pin the mutable GitHub Action refs to commit SHAs.
This workflow still uses mutable tags at the following locations:
.github/workflows/deploy-docs-preview.yml#L34/L71:actions/download-artifact@v4.github/workflows/deploy-docs-preview.yml#L110:actions/checkout@v6.github/workflows/deploy-docs-preview.yml#L204:actions/github-script@v8
Pin these to full commit SHAs so downstream action changes cannot execute through this workflow.
📍 Affects 1 file
.github/workflows/deploy-docs-preview.yml#L33-L39(this comment).github/workflows/deploy-docs-preview.yml#L70-L76.github/workflows/deploy-docs-preview.yml#L109-L116.github/workflows/deploy-docs-preview.yml#L203-L208
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-docs-preview.yml around lines 33 - 39, Replace the
mutable action tags with full commit-SHA references in
.github/workflows/deploy-docs-preview.yml: pin both actions/download-artifact
uses at lines 33-39 and 70-76, actions/checkout at lines 109-116, and
actions/github-script at lines 203-208. Preserve each action’s existing version
and configuration while ensuring all four references resolve to immutable
commits.
Source: Linters/SAST tools
| prune: | ||
| needs: read-metadata | ||
| runs-on: ubuntu-24.04 | ||
| if: needs.read-metadata.outputs.action != 'closed' |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Run pruning after deployment.
deploy and prune start concurrently because both depend only on read-metadata. If gh-pages already has six previews, prune can exit without changes before deploy adds a seventh preview.
Make prune depend on both read-metadata and deploy.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-docs-preview.yml around lines 101 - 104, Update the
prune job’s needs declaration so it depends on both read-metadata and deploy,
while preserving its existing runs-on and action condition. This ensures pruning
runs only after deployment completes.
2 participants
Notes for Reviewers
Signed commits
Summary by CodeRabbit
New Features
Chores