Skip to content

fix(CI): split documentation workflow to avoid pull_request_target checkout block #12625

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dlabaj wants to merge 3 commits into
base: main
Choose a base branch
from
+106 −11
Open

fix(CI): split documentation workflow to avoid pull_request_target checkout block #12625

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a919daa
fix(CI): split documentation workflow to avoid pull_request_target ch…
dlabaj Aug 18, 2026
1a4c6c5
fix(CI): address PR review feedback on documentation deploy workflow
dlabaj Aug 21, 2026
a58f796
fix(CI): fail ambiguous documentation deploy PR lookups
dlabaj Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 63 additions & 0 deletions .github/workflows/documentation-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
name: Documentation deploy
on:
workflow_run:
workflows: [Documentation]
types: [completed]
permissions:
actions: read
contents: read
pull-requests: read
jobs:
deploy:
name: Deploy
runs-on: ubuntu-latest
if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
env:
SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }}
SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
GH_PR_TOKEN: ${{ secrets.GH_PR_TOKEN }}
steps:
- name: Check out project
uses: actions/checkout@v4

- name: Set up project
uses: ./.github/actions/setup-project
with:
skip-build: true

- name: Resolve PR number
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
PR_NUM="${{ github.event.workflow_run.pull_requests[0].number }}"
if [ -z "$PR_NUM" ] || [ "$PR_NUM" = "null" ]; then
PR_NUM=$(gh api "repos/${{ github.repository }}/commits/${{ github.event.workflow_run.head_sha }}/pulls" --jq '.[0].number')
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
fi
if ! [[ "$PR_NUM" =~ ^[0-9]+$ ]]; then
echo "Failed to resolve a valid PR number"
exit 1
fi
echo "GH_PR_NUM=$PR_NUM" >> "$GITHUB_ENV"

- name: Download documentation
uses: actions/download-artifact@v4
with:
name: documentation
path: packages/react-docs/public
run-id: ${{ github.event.workflow_run.id }}
github-token: ${{ secrets.GITHUB_TOKEN }}

- name: Download a11y coverage
uses: actions/download-artifact@v4
with:
name: a11y-coverage
path: packages/react-docs/coverage
run-id: ${{ github.event.workflow_run.id }}
github-token: ${{ secrets.GITHUB_TOKEN }}

- name: Upload documentation
run: node .github/upload-preview.mjs packages/react-docs/public

- name: Upload accessibility results
if: always() && !cancelled()
run: node .github/upload-preview.mjs packages/react-docs/coverage
32 changes: 23 additions & 9 deletions .github/workflows/documentation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Documentation
on:
pull_request_target:
pull_request:
issue_comment:
types: [created]
workflow_call:
Expand All @@ -19,6 +19,7 @@ on:
required: true
jobs:
check-permissions:
if: github.event_name == 'issue_comment'
uses: patternfly/.github/.github/workflows/check-team-membership.yml@fdb52a63a2220ec8a3b6c2d43f312cda708ffa06
secrets: inherit

Expand All @@ -29,37 +30,50 @@ jobs:
if: >-
always() &&
!cancelled() &&
(inputs.is-release || needs.check-permissions.outputs.allowed == 'true')
(inputs.is-release || github.event_name != 'issue_comment' || needs.check-permissions.outputs.allowed == 'true')
env:
SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }}
SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
GH_PR_TOKEN: ${{ secrets.GH_PR_TOKEN }}
GH_PR_NUM: ${{ needs.check-permissions.outputs.pr-number }}
steps:
- name: Check out project from PR branch
if: github.event_name == 'pull_request_target' || github.event_name == 'issue_comment'
if: github.event_name == 'issue_comment'
uses: actions/checkout@v4
with:
# Checkout the merge commit so that we can access the PR's changes.
# This is nessesary because `pull_request_target` checks out the base branch (e.g. `main`) by default.
ref: refs/pull/${{ env.GH_PR_NUM }}/head

- name: Check out project
if: inputs.is-release || github.event_name == 'workflow_call'
if: github.event_name != 'issue_comment'
uses: actions/checkout@v4

- name: Set up and build project
uses: ./.github/actions/setup-project

- name: Build documentation
run: yarn build:docs

- name: Upload documentation
if: always()
- name: Upload documentation preview
if: always() && !cancelled() && github.event_name != 'pull_request'

@rebeccaalpert rebeccaalpert Aug 19, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need both the always() and !cancelled() calls? I am not an expert on this, but it sounds like maybe we don't: https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#always

@dlabaj dlabaj Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch — we don't need both.

GitHub's default step/job condition is success(). always() overrides that and still runs after a cancel, which is what we don't want for preview uploads. !cancelled() also overrides the default status check, but it skips canceled runs, which is the recommended alternative.

Updated this step, the a11y upload, the job-level needs condition, and the deploy workflow to use !cancelled() only in a58f796.

run: node .github/upload-preview.mjs packages/react-docs/public

- name: Run accessibility tests
run: yarn serve:docs & yarn test:a11y

- name: Upload accessibility results
if: always()
if: always() && !cancelled() && github.event_name != 'pull_request'
run: node .github/upload-preview.mjs packages/react-docs/coverage

- name: Upload docs artifact
if: github.event_name == 'pull_request'
uses: actions/upload-artifact@v4
with:
name: documentation
path: packages/react-docs/public

- name: Upload a11y artifact
if: github.event_name == 'pull_request'
uses: actions/upload-artifact@v4
with:
name: a11y-coverage
path: packages/react-docs/coverage
Loading