pages-preview.yml

name: Pages preview

on:
  workflow_run:
    workflows:
      - Website checks
    types:
      - completed

permissions:
  actions: read
  contents: read
  pull-requests: read

jobs:
  identity:
    name: Resolve trusted preview identity
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'pull_request' &&
      github.event.workflow_run.head_repository.full_name == github.repository
    runs-on: ubuntu-latest
    outputs:
      branch: ${{ steps.identity.outputs.branch }}
      head_sha: ${{ steps.identity.outputs.head_sha }}
      pull_number: ${{ steps.identity.outputs.pull_number }}
    steps:
      - name: Resolve exact internal pull request
        id: identity
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const runId = context.payload.workflow_run.id
            const { data: run } = await github.rest.actions.getWorkflowRun({
              owner: context.repo.owner,
              repo: context.repo.repo,
              run_id: runId,
            })
            if (run.name !== 'Website checks' || run.path !== '.github/workflows/website-check.yml') {
              core.setFailed('Preview must be orchestrated by the trusted Website checks workflow.')
              return
            }
            if (run.conclusion !== 'success' || run.event !== 'pull_request') {
              core.setFailed('Preview delivery requires a successful pull-request check run.')
              return
            }
            if (run.head_repository?.full_name !== `${context.repo.owner}/${context.repo.repo}`) {
              core.setFailed('Fork pull requests are not eligible for preview credentials.')
              return
            }

            const pulls = await github.rest.repos.listPullRequestsAssociatedWithCommit({
              owner: context.repo.owner,
              repo: context.repo.repo,
              commit_sha: run.head_sha,
            })
            const pull = pulls.data.find((candidate) =>
              candidate.state === 'open' &&
              candidate.base.ref === 'main' &&
              candidate.head.sha === run.head_sha &&
              candidate.head.repo?.full_name === `${context.repo.owner}/${context.repo.repo}`
            )
            if (!pull) {
              core.setFailed('Run is not the exact head of an eligible internal pull request.')
              return
            }

            core.setOutput('branch', `preview/docs/pr-${pull.number}`)
            core.setOutput('head_sha', run.head_sha)
            core.setOutput('pull_number', String(pull.number))

  deploy:
    name: Deploy isolated pull-request preview
    needs: identity
    concurrency:
      group: pages-preview-docs-${{ needs.identity.outputs.pull_number }}
      cancel-in-progress: true
    permissions:
      contents: read
      deployments: write
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment:
      name: preview
      url: ${{ steps.pages.outputs.pages-deployment-alias-url }}
    steps:
      - name: Checkout the trusted preview controller
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          path: controller
          persist-credentials: false

      - name: Checkout the exact pull-request head
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.identity.outputs.head_sha }}
          path: candidate
          persist-credentials: false

      - name: Install the pinned pnpm release
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          package_json_file: candidate/website/package.json

      - name: Set up Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: candidate/website/package.json
          cache: pnpm
          cache-dependency-path: candidate/website/pnpm-lock.yaml

      - name: Build the exact-head website preview
        run: |
          pnpm --dir candidate/website install --frozen-lockfile
          pnpm --dir candidate/website check

      - name: Prepare the isolated Pages delivery
        run: |
          mkdir --parents .pages-preview
          cp --recursive candidate/website/.vitepress/dist .pages-preview/dist

      - name: Deploy to the isolated Pages preview branch
        id: pages
        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          packageManager: npm
          wranglerVersion: 4.114.0
          workingDirectory: .pages-preview
          command: >-
            pages deploy dist
            --project-name=${{ vars.CLOUDFLARE_PAGES_PROJECT }}
            --branch=${{ needs.identity.outputs.branch }}
            --commit-hash=${{ needs.identity.outputs.head_sha }}
            --commit-dirty=false

      - name: Smoke-test the exact preview deployment
        run: node controller/website/scripts/verify-pages-deployment.mjs
        env:
          CLOUDFLARE_PAGES_DEPLOYMENT_ID: ${{ steps.pages.outputs.pages-deployment-id }}
          CLOUDFLARE_PAGES_DEPLOYMENT_URL: ${{ steps.pages.outputs.pages-deployment-alias-url }}
          INKCRE_PAGES_SMOKE_MODE: preview