fix: split preview deploy to prevent secret exposure from fork PRs

.github/workflows/pr-preview-build.yml

@@ -0,0 +1,43 @@
+name: PR Preview Build
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18.20.0'
+          cache: 'npm'
+
+      - name: Install dependencies
+        uses: bahmutov/npm-install@v1
+        with:
+          useLockFile: false
+
+      - name: Build mainnet
+        run: |
+          NODE_ENV=production CONFIG=mainnet.prod node --max-old-space-size=8192 ./src/front/bin/compile
+        env:
+          DEBUG: 'app:*'
+
+      - name: Save PR metadata
+        run: echo "${{ github.event.pull_request.number }}" > pr-number.txt
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: preview-build
+          path: |
+            build-mainnet
+            pr-number.txt
+          retention-days: 1

.github/workflows/pr-preview.yml → .github/workflows/pr-preview-deploy.yml

@@ -1,91 +1,86 @@
-name: PR Preview Deploy
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  preview:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18.20.0'
-          cache: 'npm'
-
-      - name: Install dependencies
-        uses: bahmutov/npm-install@v1
-        with:
-          useLockFile: false
-
-      - name: Build mainnet
-        run: |
-          NODE_ENV=production CONFIG=mainnet.prod node --max-old-space-size=8192 ./src/front/bin/compile
-        env:
-          DEBUG: 'app:*'
-
-      - name: Deploy to Cloudflare Pages
-        id: deploy
-        uses: cloudflare/wrangler-action@v3
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          command: pages deploy build-mainnet --project-name=mcw-preview --branch=pr-${{ github.event.pull_request.number }}
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-
-      - name: Comment preview URL on PR
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const prNumber = context.payload.pull_request.number;
-            const deployUrl = '${{ steps.deploy.outputs.deployment-url }}';
-            const sha = context.payload.pull_request.head.sha.slice(0, 7);
-
-            const marker = '<!-- pr-preview-bot -->';
-            const body = [
-              marker,
-              '## Preview Deploy',
-              '',
-              '| | |',
-              '|---|---|',
-              `| **URL** | ${deployUrl} |`,
-              `| **Commit** | \`${sha}\` |`,
-              '| **Status** | ✅ Ready |',
-            ].join('\n');
-
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: prNumber,
-            });
-
-            const existing = comments.find(c => c.body && c.body.includes(marker));
-
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: prNumber,
-                body,
-              });
-            }
+name: PR Preview Deploy
+
+on:
+  workflow_run:
+    workflows: ["PR Preview Build"]
+    types: [completed]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.conclusion == 'success'
+
+    steps:
+      - name: Download build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: preview-build
+          path: .
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Read PR number
+        id: pr
+        run: |
+          NUMBER=$(cat pr-number.txt)
+          if ! [[ "$NUMBER" =~ ^[0-9]+$ ]]; then
+            echo "Invalid PR number"
+            exit 1
+          fi
+          echo "number=$NUMBER" >> $GITHUB_OUTPUT
+
+      - name: Deploy to Cloudflare Pages
+        id: deploy
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy build-mainnet --project-name=mcw-preview --branch=pr-${{ steps.pr.outputs.number }}
+
+      - name: Comment preview URL on PR
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const prNumber = ${{ steps.pr.outputs.number }};
+            const deployUrl = '${{ steps.deploy.outputs.deployment-url }}';
+            const sha = '${{ github.event.workflow_run.head_sha }}'.slice(0, 7);
+
+            const marker = '<!-- pr-preview-bot -->';
+            const body = [
+              marker,
+              '## Preview Deploy',
+              '',
+              '| | |',
+              '|---|---|',
+              `| **URL** | ${deployUrl} |`,
+              `| **Commit** | \`${sha}\` |`,
+              '| **Status** | ✅ Ready |',
+            ].join('\n');
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+            });
+
+            const existing = comments.find(c => c.body && c.body.includes(marker));
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                body,
+              });
+            }