[Copilot]

PR docs previews were skipped for fork PRs. The pull_request token is read-only for forks, so the deploy and comment steps were gated on head.repo.full_name == github.repository. This PR splits build from deploy so forks get previews without giving PR code a write token.

• Build (python.yml, R.yml)

  • The pull_request trigger is unchanged, so PR code still runs unprivileged.
  • The PR deploy and comment steps are replaced by an artifact upload: docs-preview-python or docs-preview-r, each holding site/ and pr-number. The artifact is kept for 3 days.
  • pull-requests: write is removed.
  • Deploy to main on push is unchanged.

• Deploy (docs-preview-deploy.yml, new)

  • It triggers on workflow_run for Python and R, so it runs from the default branch with a write token.
  • It only proceeds when the source run's event is pull_request and its conclusion is success.
  • It downloads the artifact matching the source workflow. It then checks that the PR number is numeric, that site/index.html exists, and that there are no symlinks.
  • It deploys to previews/pr-<n>/{python,r} and posts or updates the PR comment, with one marker each for Python and R.
  • It never checks out or executes PR code. The target path is built only from the validated integer.
  • Both deploys share one gh-pages-deploy concurrency group with cancel-in-progress: false. This keeps the Python and R pushes to gh-pages from racing.

• Cleanup (docs-preview-cleanup.yml)

  • It switches from pull_request to pull_request_target, which has a write token for fork PRs, and drops the same-repo if.
  • This is safe because the job only checks out gh-pages, never PR code.
  • The PR number is passed through env: instead of being interpolated into the script.

on:
  workflow_run:
    workflows: [Python, R]
    types: [completed]

Review notes

• workflow_run workflows only run from the default branch, so fork previews start working after this is merged.
• Fork-authored HTML and JS is served from the project's Pages domain. There is no approval gate in this PR, to keep it small. A protected environment with required reviewers for fork PRs would add one.
• The workflows have not been run. The YAML has only been parsed.

[MLopez-Ibanez]

@copilot How do you make use of the repository environments docs-preview (no rules) and docs-preview-fork (required reviewers: maintainers).

[Copilot]

@copilot How do you make use of the repository environments docs-preview (no rules) and docs-preview-fork (required reviewers: maintainers).

They aren't used. Those environments were in my earlier design sketch, but the committed docs-preview-deploy.yml has no environment: key. To keep the PR small I dropped the approval gate, so fork previews deploy without a reviewer, as noted in the PR description. If you want the gate, add this to the deploy job:

environment: ${{ github.event.workflow_run.head_repository.full_name != github.repository && 'docs-preview-fork' || 'docs-preview' }}

Fork runs then wait for the maintainers' approval, and same-repo runs go straight through (docs-preview has no rules). Both environments must exist in the repo settings. I haven't made this change. Tell me if you want it added.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.86%. Comparing base (9516edf) to head (1c2cdae).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #87      +/-   ##
==========================================
+ Coverage   77.74%   77.86%   +0.11%     
==========================================
  Files          71       71              
  Lines        7577     7577              
  Branches     1476     1476              
==========================================
+ Hits         5891     5900       +9     
+ Misses       1315     1304      -11     
- Partials      371      373       +2     

Flag	Coverage Δ
R	72.20% <ø> (+<0.01%)	⬆️
python	75.09% <ø> (+0.10%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
C	74.16% <ø> (+0.17%)	⬆️
R	81.24% <ø> (ø)
Python tests	100.00% <ø> (ø)
Python src	81.46% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[MLopez-Ibanez]

@copilot The new workflow docs-preview-deploy.yml did not run and there is no comment showing the previews for R and Python.

[Copilot]

@copilot The new workflow docs-preview-deploy.yml did not run and th...

This is expected and not a bug in the workflow. workflow_run workflows only run from the default branch, and docs-preview-deploy.yml isn't on main yet, so GitHub won't trigger it for this PR. The build jobs on this PR should still have uploaded the docs-preview-python and docs-preview-r artifacts. You can check that in the run's Artifacts section.

The deploy and the preview comments will only appear after this PR is merged, on PRs opened or updated after that. I can't test it end to end before the merge. If you want to test it first, you could push the new workflow to main in a separate small PR and then re-run this PR's builds.