Repository navigation
Fix PR previews for fork PRs - #317
Merged
Merged
Conversation
actions/checkout now refuses to check out fork code in a pull_request_target workflow, which broke previews for every fork PR. Opting back in would let a PR's Gemfile or scripts read SURGE_TOKEN, so split the workflow instead: build on pull_request with no secrets, then deploy the built files from a workflow_run that never executes PR code and verifies the PR number against the built commit. Teardown stays on pull_request_target since it never checks out PR code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🗑 Deploy Preview for javalin.io deleted.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actions/checkoutto refuse checking out fork code inpull_request_targetworkflows (see Add Javalin monitoring tutorial with StatLite #316, Update virtual thread configuration on main page #315).allow-unsafe-pr-checkout: true, which would let a PR'sGemfile/scripts readSURGE_TOKEN), the preview is split:pr-preview-build.yml: builds onpull_requestwith no secrets and uploads_siteas an artifact.pr-preview-deploy.yml: runs onworkflow_run, never executes PR code, verifies the PR number against the built commit, deploys to surge, and comments.pr-previews.yml: now teardown-only (it never checks out PR code, sopull_request_targetstays safe there).Test plan
siteartifact.workflow_runonly uses the default branch's copy): push to or close/reopen Add Javalin monitoring tutorial with StatLite #316 and confirm the preview deploys and the comment appears.SURGE_TOKEN. It hasn't been exercised since April.🤖 Generated with Claude Code