From a919daa0045bd0bdc2dee0f000573f5fd1669400 Mon Sep 17 00:00:00 2001 From: Donald Labaj Date: Tue, 18 Aug 2026 13:44:02 -0400 Subject: [PATCH 1/2] fix(CI): split documentation workflow to avoid pull_request_target checkout block Rebased onto main and merged with the is-release workflow_call changes from #12598. PR builds use pull_request (artifact upload); deploy uses workflow_run. Closes #12601 Co-authored-by: Cursor --- .github/workflows/documentation-deploy.yml | 55 ++++++++++++++++++++++ .github/workflows/documentation.yml | 43 +++++++++++++---- 2 files changed, 89 insertions(+), 9 deletions(-) create mode 100644 .github/workflows/documentation-deploy.yml diff --git a/.github/workflows/documentation-deploy.yml b/.github/workflows/documentation-deploy.yml new file mode 100644 index 00000000000..9238f485b91 --- /dev/null +++ b/.github/workflows/documentation-deploy.yml @@ -0,0 +1,55 @@ +name: Documentation deploy +on: + workflow_run: + workflows: [Documentation] + types: [completed] +jobs: + deploy: + name: Deploy + runs-on: ubuntu-latest + if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion != 'cancelled' + env: + SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }} + SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }} + GH_PR_TOKEN: ${{ secrets.GH_PR_TOKEN }} + steps: + - name: Check out project + uses: actions/checkout@v4 + + - name: Set up project + uses: ./.github/actions/setup-project + with: + skip-build: true + + - name: Download PR number + uses: actions/download-artifact@v4 + with: + name: pr-number + run-id: ${{ github.event.workflow_run.id }} + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Set PR number + run: echo "GH_PR_NUM=$(cat pr-number.txt)" >> $GITHUB_ENV + + - name: Download documentation + uses: actions/download-artifact@v4 + with: + name: documentation + path: packages/react-docs/public + run-id: ${{ github.event.workflow_run.id }} + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Download a11y coverage + uses: actions/download-artifact@v4 + with: + name: a11y-coverage + path: packages/react-docs/coverage + run-id: ${{ github.event.workflow_run.id }} + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Upload documentation + run: node .github/upload-preview.mjs packages/react-docs/public + + - name: Upload accessibility results + if: always() + run: node .github/upload-preview.mjs packages/react-docs/coverage diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 22f641c9e11..a6e83398869 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -1,6 +1,6 @@ name: Documentation on: - pull_request_target: + pull_request: issue_comment: types: [created] workflow_call: @@ -19,6 +19,7 @@ on: required: true jobs: check-permissions: + if: github.event_name == 'issue_comment' uses: patternfly/.github/.github/workflows/check-team-membership.yml@fdb52a63a2220ec8a3b6c2d43f312cda708ffa06 secrets: inherit @@ -29,7 +30,7 @@ jobs: if: >- always() && !cancelled() && - (inputs.is-release || needs.check-permissions.outputs.allowed == 'true') + (inputs.is-release || github.event_name != 'issue_comment' || needs.check-permissions.outputs.allowed == 'true') env: SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }} SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }} @@ -37,29 +38,53 @@ jobs: GH_PR_NUM: ${{ needs.check-permissions.outputs.pr-number }} steps: - name: Check out project from PR branch - if: github.event_name == 'pull_request_target' || github.event_name == 'issue_comment' + if: github.event_name == 'issue_comment' uses: actions/checkout@v4 with: - # Checkout the merge commit so that we can access the PR's changes. - # This is nessesary because `pull_request_target` checks out the base branch (e.g. `main`) by default. ref: refs/pull/${{ env.GH_PR_NUM }}/head - name: Check out project - if: inputs.is-release || github.event_name == 'workflow_call' + if: github.event_name != 'issue_comment' uses: actions/checkout@v4 + - name: Set up and build project uses: ./.github/actions/setup-project - name: Build documentation run: yarn build:docs - - name: Upload documentation - if: always() + - name: Upload documentation preview + if: always() && !cancelled() && github.event_name != 'pull_request' run: node .github/upload-preview.mjs packages/react-docs/public - name: Run accessibility tests run: yarn serve:docs & yarn test:a11y - name: Upload accessibility results - if: always() + if: always() && !cancelled() && github.event_name != 'pull_request' run: node .github/upload-preview.mjs packages/react-docs/coverage + + - name: Upload docs artifact + if: always() && !cancelled() && github.event_name == 'pull_request' + uses: actions/upload-artifact@v4 + with: + name: documentation + path: packages/react-docs/public + + - name: Upload a11y artifact + if: always() && !cancelled() && github.event_name == 'pull_request' + uses: actions/upload-artifact@v4 + with: + name: a11y-coverage + path: packages/react-docs/coverage + + - name: Save PR number + if: always() && !cancelled() && github.event_name == 'pull_request' + run: echo "${{ github.event.pull_request.number }}" > pr-number.txt + + - name: Upload PR number + if: always() && !cancelled() && github.event_name == 'pull_request' + uses: actions/upload-artifact@v4 + with: + name: pr-number + path: pr-number.txt From 1a4c6c574c259ec103cf9f6bd853bd5e3a18d43c Mon Sep 17 00:00:00 2001 From: Donald Labaj Date: Fri, 21 Aug 2026 12:38:53 -0400 Subject: [PATCH 2/2] fix(CI): address PR review feedback on documentation deploy workflow - Deploy only when the Documentation workflow succeeds - Resolve PR number from workflow_run metadata with head_sha API fallback - Remove untrusted pr-number artifact from the build workflow - Upload PR artifacts only on successful build steps Co-authored-by: Cursor --- .github/workflows/documentation-deploy.yml | 30 ++++++++++++++-------- .github/workflows/documentation.yml | 15 ++--------- 2 files changed, 21 insertions(+), 24 deletions(-) diff --git a/.github/workflows/documentation-deploy.yml b/.github/workflows/documentation-deploy.yml index 9238f485b91..c93876daf47 100644 --- a/.github/workflows/documentation-deploy.yml +++ b/.github/workflows/documentation-deploy.yml @@ -3,11 +3,15 @@ on: workflow_run: workflows: [Documentation] types: [completed] +permissions: + actions: read + contents: read + pull-requests: read jobs: deploy: name: Deploy runs-on: ubuntu-latest - if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion != 'cancelled' + if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' env: SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }} SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }} @@ -21,15 +25,19 @@ jobs: with: skip-build: true - - name: Download PR number - uses: actions/download-artifact@v4 - with: - name: pr-number - run-id: ${{ github.event.workflow_run.id }} - github-token: ${{ secrets.GITHUB_TOKEN }} - - - name: Set PR number - run: echo "GH_PR_NUM=$(cat pr-number.txt)" >> $GITHUB_ENV + - name: Resolve PR number + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + PR_NUM="${{ github.event.workflow_run.pull_requests[0].number }}" + if [ -z "$PR_NUM" ] || [ "$PR_NUM" = "null" ]; then + PR_NUM=$(gh api "repos/${{ github.repository }}/commits/${{ github.event.workflow_run.head_sha }}/pulls" --jq '.[0].number') + fi + if ! [[ "$PR_NUM" =~ ^[0-9]+$ ]]; then + echo "Failed to resolve a valid PR number" + exit 1 + fi + echo "GH_PR_NUM=$PR_NUM" >> "$GITHUB_ENV" - name: Download documentation uses: actions/download-artifact@v4 @@ -51,5 +59,5 @@ jobs: run: node .github/upload-preview.mjs packages/react-docs/public - name: Upload accessibility results - if: always() + if: always() && !cancelled() run: node .github/upload-preview.mjs packages/react-docs/coverage diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index a6e83398869..1d55adafd56 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -65,26 +65,15 @@ jobs: run: node .github/upload-preview.mjs packages/react-docs/coverage - name: Upload docs artifact - if: always() && !cancelled() && github.event_name == 'pull_request' + if: github.event_name == 'pull_request' uses: actions/upload-artifact@v4 with: name: documentation path: packages/react-docs/public - name: Upload a11y artifact - if: always() && !cancelled() && github.event_name == 'pull_request' + if: github.event_name == 'pull_request' uses: actions/upload-artifact@v4 with: name: a11y-coverage path: packages/react-docs/coverage - - - name: Save PR number - if: always() && !cancelled() && github.event_name == 'pull_request' - run: echo "${{ github.event.pull_request.number }}" > pr-number.txt - - - name: Upload PR number - if: always() && !cancelled() && github.event_name == 'pull_request' - uses: actions/upload-artifact@v4 - with: - name: pr-number - path: pr-number.txt