Skip to content

fix(ci): replace pull_request_target docs deploy with safe workflow_run split - #1100

Closed
sobolevn with Copilot wants to merge 2 commits into
mainfrom
copilot/fix-ci-run-failure
Closed

fix(ci): replace pull_request_target docs deploy with safe workflow_run split#1100
sobolevn with Copilot wants to merge 2 commits into
mainfrom
copilot/fix-ci-run-failure

Conversation

Copilot AI commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

docs-deploy.yml used pull_request_target (which holds CF_ACCOUNT_ID/CF_PAGES_TOKEN) and delegated to docs.yml, which checks out and executes fork code — a classic pwn-request path. actions/checkout@v7 now refuses this combination outright.

Changes

  • New .github/workflows/docs-pr.yml — triggered by pull_request (no secrets); calls docs.yml to build fork code and upload the artifact safely in the untrusted context.
  • .github/workflows/docs-deploy.yml — removes pull_request_target; adds a workflow_run trigger that fires after docs pr completes. The new preview job downloads the pre-built artifact and deploys it — fork code is never executed in this context.
  • .github/workflows/docs.yml — updates ref input description to clarify it accepts a SHA or full ref.

Trust boundary

Stage Trigger Secrets Fork code runs?
Build pull_request ❌ ✅ safe
Deploy preview workflow_run ✅ ❌ never
Deploy production push to main ✅ ❌ never

The artifact is the boundary: untrusted runner builds HTML, trusted runner deploys the already-built output.

fix: split docs build (untrusted) from deploy (trusted) to fix pwn-re…
f1e1938 
…quest vulnerability

- Create docs-pr.yml: triggered by pull_request (no secrets), safely
  builds fork docs and uploads artifact
- Update docs-deploy.yml: remove pull_request_target trigger, add
  workflow_run trigger; preview job downloads pre-built artifact only
  and never touches fork code
- Update docs.yml: clarify ref input accepts SHA or full ref
Copilot AI changed the title [WIP] Fix CI run failure due to fork PR code checkout fix(ci): replace pull_request_target docs deploy with safe workflow_run split Jun 26, 2026
Copilot AI requested a review from sobolevn June 26, 2026 12:42
@sobolevn

sobolevn commented Jun 26, 2026

Copy link
Copy Markdown
Member

@copilot docs deploy / Build and check docs / build (pull_request_target) and docs deploy / Build and check docs / Check links (pull_request_target) duplicate docs pr / Build and check docs / Check links (pull_request) and docs pr / Build and check docs / build (pull_request). can we remove this duplication?

Copilot AI commented Jun 26, 2026

Copy link
Copy Markdown
Contributor Author

@copilot docs deploy / Build and check docs / build (pull_request_target) and docs deploy / Build and check docs / Check links (pull_request_target) duplicate `docs pr / Build an...

This duplication is transient and specific to this PR. pull_request_target workflows always run from the base branch's copy of the workflow file — so the current main docs-deploy.yml (which still has pull_request_target) fires alongside the new docs-pr.yml from this PR branch.

Once this PR is merged:

  • docs-deploy.yml on main loses the pull_request_target trigger entirely
  • Only docs-pr.yml runs for PRs (via pull_request)
  • docs-deploy.yml is then only triggered by push to main (production) and workflow_run after docs pr completes (preview deploy only — the docs build job is gated by if: github.event_name == 'push' so it's skipped on workflow_run)

No code change needed — the duplication disappears automatically when the PR lands.

@sobolevn

sobolevn commented Jun 26, 2026

Copy link
Copy Markdown
Member

I will review this tomorrow :(

@ofek

ofek commented Jun 26, 2026

Copy link
Copy Markdown
Member

@copilot What triggered you to open this PR?

@sobolevn

sobolevn commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

I was playing around with pull_request and pull_request_target differences. I don't quite understand them :)

Btw, it always shows who did this:

Copilot started work on behalf of sobolevn 10 hours ago

@ofek ofek mentioned this pull request Jun 27, 2026
Merged
@ofek

ofek commented Jun 27, 2026

Copy link
Copy Markdown
Member

Interesting, it looks like a hidden event that only you can see because the anchor takes me to the top of the page but I see nothing.

@ofek

ofek commented Jun 27, 2026

Copy link
Copy Markdown
Member

Superseded by #1101

@ofek ofek closed this Jun 27, 2026
@ofek
ofek deleted the copilot/fix-ci-run-failure branch June 27, 2026 06:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sobolevn sobolevn Awaiting requested review from sobolevn

Assignees

See More

@sobolevn sobolevn

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@sobolevn @ofek