Repository navigation
ci: isolate documentation publishing - #1290
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19e6aafbc2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| builder = source.api(f"actions/runs/{run_id}") | ||
| if ( | ||
| builder["workflow_id"] != workflow["id"] | ||
| or builder["path"] != f".github/workflows/{BUILDER}" |
There was a problem hiding this comment.
With the selected 2026-03-10 API version, workflow-run responses qualify path with the workflow ref (for example, .github/workflows/build.yml@main in the official response example), so a legitimate docs run will fail this equality check and every production/preview publisher request will stop before dispatch. The publisher outcome check at line 256 has the same problem; strip and validate the @ref suffix, or use an identity field whose documented format is unqualified.
Useful? React with 👍 / 👎.
Intent
Fork documentation builds can finish successfully after maintainer approval while the current
pull_request_targetpublisher has already failed onaction_required. Move publishing authority to msgspec/docs-deploy so successful build completion starts publication and source maintainers cannot redirect Cloudflare credentials to another project.Changes
Build documentation for PRs and main pushes, then use a trusted
workflow_runbridge to dispatch the isolated publisher with only the build run ID and attempt. The publisher independently validates source metadata, artifact provenance and digest, and the fixed destination. A nativeDocs previewPR job waits for the matching bridge result, fails visibly on build or publication failure, and exposes the preview through an empty environment.Full build reruns replace the docs artifact, while link-only retries can reuse that run's artifact. Add orchestration regressions to build preparation and document the preview and retry behavior for contributors.
Validation
python -m unittest discover -s tests -p test_docs_deploy.pyuvx --from ruff==0.17.0 ruff check scripts/docs_deploy.py tests/test_docs_deploy.pyuvx --from ruff==0.17.0 ruff format --check scripts/docs_deploy.py tests/test_docs_deploy.pyactionlint .github/workflows/docs-deploy.yml .github/workflows/docs-pr.yml .github/workflows/docs.yml .github/workflows/prepare-build.ymlzizmor --offline .githubuvx codespell scripts/docs_deploy.py tests/test_docs_deploy.py .github/CONTRIBUTING.mdThe publisher's CI run passed all 41 tests. A live read-only validation of fork PR #1214 resolved run
39306143416, downloaded artifact12212809134, verified its SHA-256 digest, and validated all 115 static files.Notes
This is the activation change. The GitHub App is installed with Actions write, Contents read, Pull requests read, and Metadata read permissions. A live fork preview canary passed in publisher run
39384183375, and invalid-attempt run39384251513failed before either publishing job started. A production canary must pass before retiring the old source Cloudflare credentials and removing the merge queue and obsolete capability restrictions. The requiredDocs previewstatus will be enabled during that final cutover, with strict branch-update enforcement disabled. Before the bridge reaches main, this draft's new preview job will wait for activation.