[CI]: Restructure and Standardize the preview-deploy workflow across repos subscribed to the meshery-academy topic. - #101
Conversation
This PR fixes meshery-extensions#86 Refactors the single preview-deploy workflow into three decoupled workflows following GitHub's recommended trust-separation pattern for pull request previews: 1. preview-build-pr.yml & preview-build.yml: Unprivileged build stage running under pull_request with read-only permissions. 2. preview-deploy-pr.yml & preview-deploy.yml: Privileged deployment stage running under workflow_run (when build succeeds) with contents: write permissions, publishing to gh-pages with artifact sanity checks and retry loops. 3. preview-cleanup-pr.yml & preview-clean.yml: Cleanup stage running on pull_request_target (closed) to prune preview directories and notify PR authors. Standardizes preview deployment architecture aligned with tcslabs-academy meshery-extensions#36. Signed-off-by: MrDadhich456 <aaryandadhich2006@gmail.com>
📝 WalkthroughWalkthroughThe PR preview deployment is replaced with separate build, artifact-based deployment, and cleanup workflows. Builds run on pull requests, deployments publish validated artifacts to ChangesPR preview pipeline
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/preview-build.yml (1)
34-61: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winDelegate the preview build to the repo target
The workflow already defines
build-previewfor the npm-managed Hugo preview build. Drop the separatepeaceiris/actions-hugostep and runmake build-previewafter the existingnpm ci, exporting the preview URL asDEPLOY_PRIME_URLso the build logic stays in one place.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/preview-build.yml around lines 34 - 61, The preview workflow should use the repository’s existing build target instead of invoking Hugo directly. Remove the “Setup Hugo” step, keep “Install dependencies” with npm ci, and update “Build preview” to export the existing BASE_URL value as DEPLOY_PRIME_URL before running make build-preview.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/preview-build-pr.yml:
- Around line 3-6: The pull request trigger in the workflow hardcodes the base
branch as master, preventing reuse by repositories with different default
branches. Add a workflow_call base-branch input and use it to parameterize the
pull_request branches filter, following the existing deployment-url input
pattern; apply the same change to preview-deploy.yml and preview-cleanup-pr.yml.
---
Nitpick comments:
In @.github/workflows/preview-build.yml:
- Around line 34-61: The preview workflow should use the repository’s existing
build target instead of invoking Hugo directly. Remove the “Setup Hugo” step,
keep “Install dependencies” with npm ci, and update “Build preview” to export
the existing BASE_URL value as DEPLOY_PRIME_URL before running make
build-preview.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 80278187-94b9-465a-8121-28e7270bac38
📒 Files selected for processing (7)
.github/workflows/deploy-preview.yml.github/workflows/preview-build-pr.yml.github/workflows/preview-build.yml.github/workflows/preview-clean.yml.github/workflows/preview-cleanup-pr.yml.github/workflows/preview-deploy-pr.yml.github/workflows/preview-deploy.yml
💤 Files with no reviewable changes (1)
- .github/workflows/deploy-preview.yml
| on: | ||
| pull_request: | ||
| branches: [master] | ||
| types: [opened, synchronize, reopened] |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Hardcoded master branch limits cross-repo reuse.
This workflow is intended to be applied consistently across repos subscribed to the meshery-academy topic, but the base branch is hardcoded here (and mirrored in preview-deploy.yml and preview-cleanup-pr.yml). Any repo using main (or another default branch name) would silently never trigger this pipeline. Consider making the base branch a workflow_call input, consistent with how deployment-url is already parameterized.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/preview-build-pr.yml around lines 3 - 6, The pull request
trigger in the workflow hardcodes the base branch as master, preventing reuse by
repositories with different default branches. Add a workflow_call base-branch
input and use it to parameterize the pull_request branches filter, following the
existing deployment-url input pattern; apply the same change to
preview-deploy.yml and preview-cleanup-pr.yml.
|
|
1 participant
Notes for Reviewers
This PR fixes #86
Standardizes the PR preview-deploy workflow on
digitalocean-academyfollowing the reference implementation established in meshery-extensions/tcslabs-academy#36 across repositories subscribed to themeshery-academytopic.Summary
Replaces the legacy single
deploy-preview.ymlworkflow with three decoupled workflows that implement GitHub's recommended 2-stage trust separation pattern for pull request previews: an unprivileged build stage, a privileged deploy stage communicating via build artifacts, and a cleanup stage on PR closure.Architecture & Workflows Added
preview-build-pr.yml&preview-build.yml(Build Stage)pull_request(opened,synchronize,reopened) againstmaster.contents: read(safe for external fork contributions).0.158.0extended, builds the site viahugo --environment dev, and uploads thepublic/directory as a 1-day artifact (preview-site).preview-deploy-pr.yml&preview-deploy.yml(Deploy Stage)workflow_runwhenPreview Buildcompletes withconclusion == 'success'.contents: write,pull-requests: write,actions: read.index.htmlpresence, removing smuggled symlinks, <200MB size limit), matchesHEAD_SHAto open PRs via GitHub API, publishes togh-pagesunderpr-preview/pr-<number>/, and posts/updates a sticky PR comment with the preview URL.preview-cleanup-pr.yml&preview-clean.yml(Cleanup Stage)pull_request_target: [closed]andworkflow_dispatch.contents: write,pull-requests: write.gh-pagesfor closed PRs or to maintain the retention limit (retention_limit: 6).Key Fixes & Feedback Incorporated from PR #36
if: github.event_name == 'pull_request'inside the reusable workflowpreview-build.yml(sincegithub.event_nameevaluates to'workflow_call'when invoked viaworkflow_call).continue-on-error: trueto the notification step inpreview-clean.ymlso transient GitHub API glitches don't cause an otherwise successfulgh-pagescleanup to fail.gh-pages.git pushoperations for both deploy and clean steps.Verification Plan
Automated Verification
Manual Verification Steps (Upon Merging / PR Push)
Preview Buildunderpull_requestwithcontents: readpermissions.Preview Buildsucceeds,Preview Deploytriggers viaworkflow_run, downloads the artifact, updatesgh-pages/pr-preview/pr-<number>/, and posts the preview URL comment.Preview Cleanup, removingpr-preview/pr-<number>/fromgh-pagesand leaving a cleanup notice.Signed-off-by
MrDadhich456 <aaryandadhich2006@gmail.com>Summary by CodeRabbit