Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions .github/scripts/resolve-preview-pull-request.ts
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,11 @@ interface PermissionResponse {
role_name: string | null;
}

interface PullRequestFile {
filename: string;
previous_filename: string | null;
}

const parsePullRequest = (value: JsonValue): PullRequest => {
const item = asRecord(value);
const base = asRecord(getJsonField(item, "base"));
Expand Down Expand Up @@ -145,6 +150,17 @@ const parsePermissionResponse = (value: JsonValue): PermissionResponse => {
};
};

const parsePullRequestFile = (value: JsonValue): PullRequestFile => {
const item = asRecord(value);

return {
filename: asString(getJsonField(item, "filename")),
previous_filename: asOptionalString(
getJsonField(item, "previous_filename")
),
};
};

const payload = parsePayload(await readEvent());
const defaultBranch = payload.repository?.default_branch ?? null;

Expand Down Expand Up @@ -256,6 +272,30 @@ if (eventName() === "workflow_run" && !matchesWorkflowRun(pullRequest)) {
process.exit(0);
}

const pullRequestFiles =
eventName() === "pull_request_target"
? []
: await githubPaginate(
`/repos/${githubRepository.owner}/${githubRepository.repo}/pulls/${pullRequest.number}/files`,
parsePullRequestFile
);

const docsChanged =
eventName() === "pull_request_target" ||
pullRequestFiles.some(
(file) =>
file.filename.startsWith("apps/web/") ||
file.previous_filename?.startsWith("apps/web/") === true
);

await setOutput("docs_changed", String(docsChanged));

if (!docsChanged && eventName() === "workflow_run") {
console.info(
`Pull request #${pullRequest.number} does not change apps/web; skipping documentation preview deployment.`
);
}

const username = pullRequest.user?.login ?? null;

if (!username) {
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/deploy-preview.yml
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ jobs:
outputs:
pull_request_number: ${{ steps.resolve.outputs.pull_request_number }}
trusted: ${{ steps.resolve.outputs.trusted }}
docs_changed: ${{ steps.resolve.outputs.docs_changed }}
steps:
- name: Checkout trusted workflow scripts
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Expand All @@ -56,7 +57,7 @@ jobs:
name: Announce preview approval
needs: resolve
if: >-
github.event_name == 'workflow_run' && needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.trusted != 'true'
github.event_name == 'workflow_run' && needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.docs_changed == 'true' && needs.resolve.outputs.trusted != 'true'
runs-on: ubuntu-24.04
permissions:
issues: write
Expand Down Expand Up @@ -85,7 +86,7 @@ jobs:
deploy:
name: Deploy preview (review required)
needs: resolve
if: needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.trusted != 'true'
if: needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.docs_changed == 'true' && needs.resolve.outputs.trusted != 'true'
runs-on: ubuntu-24.04
# Required reviewers protect the Cloudflare credentials when the PR author
# does not have write access and the deployment executes pull-request code.
Expand All @@ -110,7 +111,7 @@ jobs:
deploy-trusted:
name: Deploy preview (trusted author)
needs: resolve
if: needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.trusted == 'true'
if: needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.docs_changed == 'true' && needs.resolve.outputs.trusted == 'true'
runs-on: ubuntu-24.04
# A write-level PR author is trusted to run pull-request code with the
# repository's Cloudflare credentials, so no reviewer gate is needed.
Expand Down