deploy-preview.yml

# Because C.I. jobs could expose secrets to malicious pull requsets,
# GitHub prevents (by default) exposing action secrets to pull requests
# from forks.
#
# This is great, however, the jobs that use the secrets are still useful on
# pull requests.
#
# To run a _trusted_ workflow, we can trigger it from an event from an _untrusted_
# workflow. This keeps the secrets out of reach from the fork, but still allows
# us to keep the utility of pull request preview deploys, browserstack running, etc.
# Normally, this _trusted_ behavior is offloaded by Cloudflare, Netlify, Vercel, etc
# -- their own workers are trusted and can push comments / updates to pull requests.
#
# We don't want to use their slower (and sometimes paid) hardware.
# When we use our own workflows, we can re-use the cache built from the PR
# (or elsewhere).
#
# To be *most* secure, you'd need to build all the artifacts in the PR,
# then upload them to then be downloaded in the trusted workflows.
# Trusted workflows should not run any scripts from a PR, as malicious
# submitters may tweak the build scripts.
# Since all build artifacts are for the web browser, and not executed in
# node-space, we can be reasonably confident that downloading and testing/deploying
# those artifacts does not compromise our secrets.
#
#
# More information here:
#   https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
#
# Things that would make this easier:
#   Readablity: https://github.com/actions/download-artifact/issues/172
#   Security:
#    - if there was a way to avoid pnpm install *entirely*
name: Deploy Preview

# read-write repo token
# access to secrets
on:
  workflow_dispatch:
    inputs:
      prNum:
        description: 'PR #'
        required: true
        type: string

  workflow_run:
    workflows: ["CI"]
    types:
      # as early as possible
      - requested

concurrency:
  group: deploy-preview-${{ github.ref }}
  cancel-in-progress: true

env:
  TURBO_API: http://127.0.0.1:9080
  TURBO_TOKEN: this-is-not-a-secret
  TURBO_TEAM: myself


jobs:
  # This is the only job that needs access to the source code
  Build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [determinePR]
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
      - name: TurboRepo local server
        uses: felixmosh/turborepo-gh-artifacts@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: wyvox/action-setup-pnpm@v3
      - run: pnpm turbo build:dev
      - uses: actions/upload-artifact@v4
        with:
          name: deploy-prep-dist
          if-no-files-found: error
          path: |
            ./docs-app/dist/**/*
            !node_modules/
            !./**/node_modules/

#################################################################
# For the rest:
# Does not checkout code, has access to secrets
#################################################################

  # debug:
  #   runs-on: ubuntu-latest
  #   steps:
  #     - run: echo "${{ toJson(github.event) }}"
  #     - run: echo "${{ toJson(github.event.workflow_run) }}"

  determinePR:
    # this job gates the others -- if the workflow_run request did not come from a PR,
    # exit as early as possible
    runs-on: ubuntu-latest
    if: github.event.workflow_run.event == 'pull_request' || github.event.inputs.prNum
    outputs:
      number: ${{ steps.number.outputs.pr-number }}
    steps:
      - run: echo "${{ github.event.workflow_run.pull_requests[0].number || github.event.inputs.prNum }}"
        id: number

  DeployPreview_Docs:
    name: "Deploy: Preview"
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [Build]
    permissions:
      contents: read
      deployments: write
    outputs:
      docsUrl: ${{ steps.deploy.outputs.url }}
    steps:
      - uses: actions/download-artifact@v4
        name: deploy-prep-dist
      - id: deploy
        uses: cloudflare/pages-action@v1.5.0
        with:
          branch: ${{ github.event.workflow_run.head_branch }}
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          projectName: ember-primitives
          directory: ./deploy-prep-dist/
          gitHubToken: ${{ secrets.GITHUB_TOKEN }}

  PostComment:
    name: Post Preview URL as comment to PR
    runs-on: ubuntu-latest
    needs: [DeployPreview_Docs]
    permissions:
      pull-requests: write
    steps:
      - uses: marocchino/sticky-pull-request-comment@v2
        with:
          header: preview-urls
          number: ${{ github.event.workflow_run.pull_requests[0].number }}
          message: |+
            | Project   | Preview URL |
            | -------   | ----------- |
            | Docs    | ${{ needs.DeployPreview_Docs.outputs.docsUrl }}   |

            [Logs](https://github.com/universal-ember/ember-primitives/actions/runs/${{ github.run_id }})