ci(previews): build, check, and preview every pull request - #21
Conversation
No workflow ran on pull requests: the only automation was a push-to-main deploy. Reviewers had to check out a branch to see a documentation change, and a broken internal link could reach production unnoticed. The upcoming documentation work expects outside contributors, so review needs to be possible from the pull request itself. Add three workflows. "PR build" runs on every pull request, builds the site, and validates internal documentation links; it holds no secrets, so it is safe for forks. It uploads the built site as an artifact. "Preview deploy" picks that artifact up through workflow_run, uploads it to Cloudflare Pages under a pr-<number> branch alias, and posts a single sticky comment with the URL. "Preview teardown" deletes those deployments when the pull request closes, with a weekly sweep for anything missed. Preview builds render an orange banner linking back to the pull request and carry noindex, so a preview cannot be mistaken for the published site or compete with it in search. Production builds set none of the preview variables, so nothing changes on siloserver.org. Cloudflare credentials live in the Preview environment rather than in repository secrets, which keeps them unreadable from the workflow that runs contributor code. Also move the Starlight sidebar into src/data/sidebar.mjs so adding a page no longer means editing astro.config.mjs, and correct the documentation edit link to the current repository name. Link validation caught one existing broken link in installation.md, fixed here. Preview deployment cannot run on this pull request: workflow_run triggers only fire once the workflow file is on the default branch. The first preview will appear on the next pull request opened after this merges. Validation: - bun install --frozen-lockfile && bun run build (passes, link validation on) - Preview build with PUBLIC_PREVIEW_* set: banner and noindex present on the homepage, a docs page, and a policy page; canonical and OpenGraph URLs resolve to the preview origin - Production build: no banner, no robots tag on the same three pages - Screenshot of the preview banner at 390px width attached to the pull request AI-assisted contribution. Written by Claude Opus 5 (claude-opus-5) running in Claude Code, at the maintainer's direction. Workflow deployment paths have not been executed; they require the Cloudflare project and secrets to be in place.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
GitHub rejected pr-build.yml outright: "This run likely failed because of a workflow file issue", with no jobs created. The _headers step used a plain scalar whose value contains "X-Robots-Tag: noindex", and YAML reads that inner colon-space as a nested mapping inside a compact mapping, which is invalid. Use a block scalar for the run value. Behaviour is unchanged. Validated by parsing every workflow with a YAML 1.2 parser, including the pre-existing deploy.yml as a known-good control. All four parse, and the triggers resolve as intended. AI-assisted contribution. Written by Claude Opus 5 (claude-opus-5) running in Claude Code, at the maintainer's direction.
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bcf8a03384
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Automated review of #21 found defects that would have made the preview pipeline unsafe or simply non-functional. Each was verified against the source before changing anything. Artifact metadata no longer decides where a deployment lands. The privileged workflow took the pull request number and commit from a file written by the unprivileged build, which a fork can edit. A contributor could have replaced another pull request's preview, overwritten its comment, and set a status on an unrelated commit. Identity now comes from the trusted workflow_run event: the head SHA from the payload, and the pull request resolved through the GitHub API, requiring an open pull request whose head matches. Anything else is skipped and the metadata artifact is gone. Add statuses: write. The final step calls createCommitStatus, which is not covered by contents: read or pull-requests: write, so every deploy would have failed at the last step after already deploying and commenting. Rewrite teardown against the Cloudflare REST API. The jq filters expected raw fields, but `wrangler pages deployment list` renames them for display and omits creation time, so the close path would have matched nothing and the scheduled sweep would have failed under set -e. Previews would have accumulated indefinitely. The API returns the raw records and is paginated here, so the sweep is not limited to the most recent page. Serialize deploys per source branch. Build concurrency does not order deploy jobs that already started, so a slower older upload could land last and leave the alias on stale content. Drop GITHUB_TOKEN from the build step. It was added so preview client cards would match production, but it handed a live credential to contributor- controlled build code and broke the no-secrets boundary this design depends on. Release lookups fall back to plain repository links in previews, which never fails the build. Pin the actions in the credential-bearing workflows to commit SHAs, and pin the Wrangler version. This also fixes a reference to marocchino/sticky-pull-request-comment@v2, a tag that does not exist; the step would have failed. Pinned to v3.0.5. Validated by parsing every workflow with a YAML 1.2 parser and exercising both jq filters against sample API payloads, including a record with no branch metadata. bun run build still passes. AI-assisted contribution. Written by Claude Opus 5 (claude-opus-5) running in Claude Code, at the maintainer's direction. The deploy and teardown paths still have not executed; they require the workflows to be on the default branch.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 779ad16820
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 445bd7270a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Preview removed after this pull request was closed. |
This branch was successfully deployed
1 participant
Problem
No workflow ran on pull requests. The only automation was a push-to-
maindeploy, so:bun run devto see a content or design change.The upcoming documentation work expects outside contributors, so review needs to be possible from the pull request itself.
Solution
Three workflows, split so that the job running contributor code never holds a secret.
pr-build.ymlpull_requestdistas an artifactpreview-deploy.ymlworkflow_runPreviewenv)preview-teardown.ymlPreviewenv)Previews land at
https://pr-<number>.temp-siloserver-org.pages.dev. The alias is repointed on every push, so the link in the comment always shows the latest build.Preview builds render an orange banner linking back to the pull request and carry
noindex, so a preview cannot be mistaken for the published site or compete with it in search. Production builds set none of the preview variables, so nothing changes on siloserver.org.Cloudflare credentials live in the
PreviewGitHub environment rather than in repository secrets. Repository secrets are readable by anypull_requestjob on a same-repo branch, which would defeat the split; environment secrets are not.Also included
src/data/sidebar.mjs, so adding a documentation page no longer means editingastro.config.mjs.silo-websitetosiloserver.org; it was only working through GitHub's rename redirect.installation.md(a trailing slash, which conflicts withtrailingSlash: "never"). Fixed.Validation
Passes with link validation enabled.
PUBLIC_PREVIEW_*set): banner andnoindexpresent on the homepage, a docs page, and a policy page; canonical and OpenGraph URLs resolve to the preview origin.env.PREVIEW_PROJECTreference was checked against GitHub's context-availability table; all sit insteps.*.env,steps.*.with, orsteps.*.run, where theenvcontext is valid.Preview banner on a docs page at 390px:
I could not capture a desktop-width screenshot: headless Chrome and Brave both refused 1440px captures on this machine, though 390px worked. The banner is a single full-width element, so the mobile capture shows its full styling.
Expected: no preview on this pull request
workflow_runtriggers only fire once the workflow file exists on the default branch. On this PR,pr-build.ymlwill run and produce the artifact, but no preview will deploy and no comment will appear. The first real preview arrives on the next pull request opened after this merges. The deploy and teardown paths are therefore unexecuted in this change.Before merging
buildjob of "PR build" as a required status check onmain.The Cloudflare project (
temp-siloserver-org, direct upload) and thePreviewenvironment withCLOUDFLARE_API_TOKENandCLOUDFLARE_ACCOUNT_IDare already in place. The project name is set once per workflow asPREVIEW_PROJECT; when previews move to an organization-owned Cloudflare account, create the project there and update that value in the three files.AI-assisted contribution. Written by Claude Opus 5 (
claude-opus-5) running in Claude Code, at the maintainer's direction. Workflow deployment paths have not been executed; they require the Cloudflare project and secrets to be exercised by a real run.