ci(preview): link composer PR previews to a GitHub Environment#11487
Open
dmaretskyi wants to merge 1 commit into
Open
ci(preview): link composer PR previews to a GitHub Environment#11487dmaretskyi wants to merge 1 commit into
dmaretskyi wants to merge 1 commit into
Conversation
Create a GitHub Deployment against the PR head SHA from the workflow_run-triggered deploy job so the preview appears in the PR's Deployments sidebar and View deployment button. Uses a transient, per-PR environment (composer-preview-pr-N) that auto-deactivates on merge.
|
Review changes with |
Contributor
📝 WalkthroughWalkthroughThe workflow's GitHub token permissions are expanded to write deployments. Deployment metadata (branch alias, environment name, environment URL) is extracted from the preview artifact, used to create a GitHub Deployment record with an initial "in_progress" status, and the deployment ID is stored. After Cloudflare Pages deployment, conditional steps update the deployment status to success or failure. ChangesGitHub Deployments Integration for PR Previews
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
📝 TODOs✅ No new TODOs found in this PR! |
Contributor
Composer preview
Built from be76be8. |
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/preview-deploy.yml (1)
61-61: ⚡ Quick winPin actions/github-script to a commit hash.
The action reference uses a mutable tag (
@v7) rather than an immutable commit SHA. Pinning to a specific commit hash prevents supply-chain attacks if the tag is moved or the action is compromised.🔒 Suggested fix
- - name: Create GitHub Deployment - id: deployment - uses: actions/github-script@v7 + - name: Create GitHub Deployment + id: deployment + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1Note: The same issue exists at lines 105 and 120, and pre-existing actions at lines 27 and 133 are also unpinned. Consider pinning all actions in this workflow for consistency.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/preview-deploy.yml at line 61, The workflow currently references the mutable tag "actions/github-script@v7"; replace that with an immutable commit SHA (e.g., actions/github-script@<commit-sha>) so the action is pinned to a specific release, and do the same for any other unpinned actions in the same workflow (the other occurrences of actions/github-script and any uses: entries that use tags like `@v7/`@latest); locate the uses: actions/github-script@v7 entry and update it to use the corresponding commit hash, and scan the file for other unpinned uses: lines (including the other actions the reviewer noted) and pin each to their verified commit SHAs for consistency and supply-chain security.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/preview-deploy.yml:
- Line 61: The workflow currently references the mutable tag
"actions/github-script@v7"; replace that with an immutable commit SHA (e.g.,
actions/github-script@<commit-sha>) so the action is pinned to a specific
release, and do the same for any other unpinned actions in the same workflow
(the other occurrences of actions/github-script and any uses: entries that use
tags like `@v7/`@latest); locate the uses: actions/github-script@v7 entry and
update it to use the corresponding commit hash, and scan the file for other
unpinned uses: lines (including the other actions the reviewer noted) and pin
each to their verified commit SHAs for consistency and supply-chain security.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 3a312b7d-a6c3-4251-a607-760b7fb2e7dd
📒 Files selected for processing (1)
.github/workflows/preview-deploy.yml
Contributor
Run report for be76be84Total time: 3m 36s | Comparison time: 81m 37s | Estimated savings: 78m 1s (95.6% faster)
Expanded report
Changed files |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #11487 +/- ##
==========================================
+ Coverage 43.01% 45.43% +2.41%
==========================================
Files 1381 1151 -230
Lines 40353 34709 -5644
Branches 9797 8438 -1359
==========================================
- Hits 17359 15769 -1590
+ Misses 19444 16015 -3429
+ Partials 3550 2925 -625 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Make composer PR preview deploys show up on the PR as a GitHub Environment (Deployments sidebar / "View deployment" button), in addition to the existing sticky comment.
Why this isn't just
environment:on the jobThe Preview Deploy workflow runs via
workflow_runso it can use secrets safely. That means its checkout ref is the base branch, not the PR head. The built-inenvironment:job key creates the deployment record against the workflow's ref, which would attach the deployment tomainrather than the PR — so it would never appear on the PR.To attach to the PR, the deployment must be created via the API with
ref= PR head SHA. This PR addsactions/github-scriptcalls that do exactly that:ref= PR head SHA (read from the trusted artifact metadata) andenvironment=composer-preview-pr-<N>.in_progressbefore wrangler runs, thensuccessorfailureafter.transient_environment: trueso old PR environments auto-deactivate when the PR is closed/merged.deployments: writeandstatuses: writepermissions.The existing sticky PR comment is preserved.
Test plan
dxos/dxos; verify Preview Build succeeds and Preview Deploy creates a deployment.https://pr-<N>.composer-app.pages.dev.composer-previewcomment still posts.Generated by Claude Code
Summary by CodeRabbit