Skip to content

Commit 1ea1c41

Browse files
author
Victor Viale
committed
Switch to a privileged workflow setup to avoid extracting secrets
1 parent 364df9f commit 1ea1c41

3 files changed

Lines changed: 116 additions & 52 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 20 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,13 @@ name: Continuous Integration
33
on:
44
pull_request:
55
branches: ["**"]
6-
types: [opened, synchronize, reopened, closed]
76
push:
87
branches: ["main"]
98

10-
env:
11-
BRANCH_NAME: pr-${{ github.event.pull_request.number }}
12-
CLOUDFLARE_PAGES_PROJECT_NAME: typelevel-website
13-
149
jobs:
1510
build:
1611
name: Build and Test
1712
runs-on: ubuntu-latest
18-
if: github.event.action != 'closed'
1913
steps:
2014
- uses: actions/checkout@v6
2115
- uses: actions/setup-java@v5
@@ -28,55 +22,29 @@ jobs:
2822
scala-cli-version: 1.12.2
2923
- run: scala-cli fmt --check .
3024
- run: scala-cli --server=false build.scala
31-
- name: Publish to Cloudflare Pages
32-
if: github.event_name == 'pull_request' && github.event.pull_request.merged != true
33-
uses: cloudflare/wrangler-action@v4
25+
- name: Save PR number
26+
if: github.event_name == 'pull_request'
27+
run: echo "${{ github.event.pull_request.number }}" > pr_number.txt
28+
- name: Upload site artifact
29+
if: github.event_name == 'pull_request'
30+
uses: actions/upload-artifact@v4
31+
with:
32+
name: site
33+
path: target
34+
if-no-files-found: error
35+
retention-days: 30
36+
- name: Upload PR number artifact
37+
if: github.event_name == 'pull_request'
38+
uses: actions/upload-artifact@v4
3439
with:
35-
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
36-
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
37-
gitHubToken: ${{ secrets.GITHUB_TOKEN }}
38-
command: pages deploy ./target --project-name=${{ env.CLOUDFLARE_PAGES_PROJECT_NAME }} --branch=${{ env.BRANCH_NAME }}
39-
- if: github.event_name != 'pull_request'
40+
name: pr-number
41+
path: pr_number.txt
42+
if-no-files-found: error
43+
retention-days: 30
44+
- name: Publish to GitHub Pages
45+
if: github.event_name == 'push'
4046
uses: peaceiris/actions-gh-pages@v4.0.0
4147
with:
4248
github_token: ${{ secrets.GITHUB_TOKEN }}
4349
publish_dir: target
4450
cname: typelevel.org
45-
46-
cleanup-preview:
47-
name: Delete Cloudflare Pages preview deployments
48-
runs-on: ubuntu-latest
49-
if: github.event_name == 'pull_request' && github.event.action == 'closed'
50-
steps:
51-
- name: Delete deployments for this PR's branch
52-
env:
53-
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
54-
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
55-
run: |
56-
set -euo pipefail
57-
58-
API="https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/pages/projects/$CLOUDFLARE_PAGES_PROJECT_NAME/deployments"
59-
AUTH_HEADER="Authorization: Bearer $CLOUDFLARE_API_TOKEN"
60-
61-
page=1
62-
ids=()
63-
while :; do
64-
response=$(curl -sf -H "$AUTH_HEADER" "$API?page=$page&per_page=25")
65-
count=$(echo "$response" | jq '.result | length')
66-
[ "$count" -eq 0 ] && break
67-
while IFS= read -r id; do
68-
ids+=("$id")
69-
done < <(echo "$response" | jq -r --arg branch "$BRANCH_NAME" \
70-
'.result[] | select(.deployment_trigger.metadata.branch == $branch) | .id')
71-
page=$((page + 1))
72-
done
73-
74-
if [ ${#ids[@]} -eq 0 ]; then
75-
echo "No preview deployments found for branch $BRANCH_NAME"
76-
exit 0
77-
fi
78-
79-
for id in "${ids[@]}"; do
80-
echo "Deleting deployment $id"
81-
curl -sf -X DELETE -H "$AUTH_HEADER" "$API/$id?force=true"
82-
done

‎.github/workflows/pr-preview-cleanup.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Cleanup PR Preview
2+
3+
on:
4+
pull_request_target:
5+
types: [closed]
6+
7+
permissions:
8+
contents: read
9+
10+
env:
11+
CLOUDFLARE_PAGES_PROJECT_NAME: typelevel-website
12+
BRANCH_NAME: pr-${{ github.event.pull_request.number }}
13+
14+
jobs:
15+
cleanup-preview:
16+
name: Delete Cloudflare Pages preview deployments
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Delete deployments for this PR's branch
20+
env:
21+
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
22+
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
23+
run: |
24+
set -euo pipefail
25+
26+
API="https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/pages/projects/$CLOUDFLARE_PAGES_PROJECT_NAME/deployments"
27+
AUTH_HEADER="Authorization: Bearer $CLOUDFLARE_API_TOKEN"
28+
29+
page=1
30+
ids=()
31+
while :; do
32+
response=$(curl -sf -H "$AUTH_HEADER" "$API?page=$page&per_page=25")
33+
count=$(echo "$response" | jq '.result | length')
34+
[ "$count" -eq 0 ] && break
35+
while IFS= read -r id; do
36+
ids+=("$id")
37+
done < <(echo "$response" | jq -r --arg branch "$BRANCH_NAME" \
38+
'.result[] | select(.deployment_trigger.metadata.branch == $branch) | .id')
39+
page=$((page + 1))
40+
done
41+
42+
if [ ${#ids[@]} -eq 0 ]; then
43+
echo "No preview deployments found for branch $BRANCH_NAME"
44+
exit 0
45+
fi
46+
47+
for id in "${ids[@]}"; do
48+
echo "Deleting deployment $id"
49+
curl -sf -X DELETE -H "$AUTH_HEADER" "$API/$id?force=true"
50+
done

‎.github/workflows/pr-preview-deploy.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Deploy PR Preview
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Continuous Integration"]
6+
types: [completed]
7+
8+
permissions:
9+
actions: read
10+
contents: read
11+
12+
env:
13+
CLOUDFLARE_PAGES_PROJECT_NAME: typelevel-website
14+
15+
jobs:
16+
deploy:
17+
name: Publish to Cloudflare Pages
18+
runs-on: ubuntu-latest
19+
if: >
20+
github.event.workflow_run.event == 'pull_request' &&
21+
github.event.workflow_run.conclusion == 'success'
22+
steps:
23+
- name: Download site artifact
24+
uses: actions/download-artifact@v4
25+
with:
26+
name: site
27+
path: site
28+
run-id: ${{ github.event.workflow_run.id }}
29+
github-token: ${{ secrets.GITHUB_TOKEN }}
30+
- name: Download PR number artifact
31+
uses: actions/download-artifact@v4
32+
with:
33+
name: pr-number
34+
path: .
35+
run-id: ${{ github.event.workflow_run.id }}
36+
github-token: ${{ secrets.GITHUB_TOKEN }}
37+
- name: Read PR number
38+
id: pr
39+
run: echo "branch=pr-$(cat pr_number.txt)" >> "$GITHUB_OUTPUT"
40+
- name: Deploy
41+
uses: cloudflare/wrangler-action@v4
42+
with:
43+
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
44+
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
45+
gitHubToken: ${{ secrets.GITHUB_TOKEN }}
46+
command: pages deploy ./site --project-name=${{ env.CLOUDFLARE_PAGES_PROJECT_NAME }} --branch=${{ steps.pr.outputs.branch }}

0 commit comments

Comments
 (0)