feat: Secure docs + docs publish workflows - #158
Conversation
There was a problem hiding this comment.
Pull request overview
This PR ports and modernizes the documentation publishing approach by separating the docs build (artifact creation) from the GitHub Pages deployment, and updating action pins (notably actions/checkout) to newer revisions.
Changes:
- Simplifies the reusable docs build workflow to only build docs via Bazel and upload
_buildas thegithub-pagesartifact. - Introduces a new reusable workflow to publish the
github-pagesartifact togh-pages, maintainversions.json, and optionally comment a preview link on PRs. - Removes the legacy composite action for versioned Pages deployment.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| .github/workflows/docs.yml | Streamlines docs build to always run bazel run //:docs and upload _build as a single, stable artifact name (github-pages). |
| .github/workflows/docs-publish.yml | Adds a reusable workflow intended to deploy docs artifacts to gh-pages and GitHub Pages, including versions tracking and PR preview commenting. |
| .github/actions/deploy-versioned-pages/action.yml | Removes the deprecated composite action previously used for versioned Pages deployment. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| id: metadata | ||
| run: | | ||
| EVENT_NAME="${{ github.event.workflow_run.event }}" | ||
| PR_NUMBER="${{ github.event.workflow_run.pull_requests[0].number }}" |
There was a problem hiding this comment.
This does not seem to work. This pull request got no comment:
The associated workflow run did not get a pull request number:
There was a problem hiding this comment.
idea: docs workflow writes metadata file containing pull request number into artifacts. Then this metadata is used in the docs publish workflow
AlexanderLanin
left a comment
AlexanderLanin
left a comment
There was a problem hiding this comment.
This is a significant improvement over the original #124, but its not ready yet unfortunately
|
commits taken over to #124 with a force push. closing here. |
Full rewrite and split of docs workflow. The more dangerous build actions are now run in less privileged contexts. Only uploading artifacts and posting a comment needs more privileges which is now moved into a separate workflow which does not run attacker code.
Proven in use at
Ported #124 to current main branch and use up to date
actions/checkout.