chore: added deploy and redeploy documentation preview workflows (#DS-4784)

.github/workflows/build.yml

@@ -0,0 +1,16 @@
+name: Build
+
+on:
+  pull_request:
+
+permissions:
+  contents: read # for actions/checkout to read the repository
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ./.github/workflows/actions/setup-node
+      - uses: ./.github/workflows/actions/build-packages
+      - uses: ./.github/workflows/actions/build-docs

.github/workflows/deploy-preview.yml

@@ -0,0 +1,28 @@
+name: Deploy documentation preview
+
+on:
+  pull_request:
+
+permissions:
+  checks: write # for FirebaseExtended/action-hosting-deploy to create a check run
+  contents: read # for actions/checkout to read the repository
+  pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs
+
+jobs:
+  deploy:
+    if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository && contains(fromJSON('["OWNER", "MEMBER", "CONTRIBUTOR"]'), github.event.pull_request.author_association) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ./.github/workflows/actions/setup-node
+      - uses: ./.github/workflows/actions/build-packages
+      - uses: ./.github/workflows/actions/build-docs
+      - uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0
+        with:
+          repoToken: '${{ secrets.GITHUB_TOKEN }}'
+          firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}'
+          firebaseToolsVersion: '15.3.1'
+          expires: 3d
+          channelId: prs-${{ github.event.number }}
+          projectId: koobiq
+          target: next

.github/workflows/e2e-approve-snapshots.yml

@@ -1,16 +1,21 @@
+# Triggered workflow by PR comment: /approve-snapshots
+#
+# ⚠️ This job checks out and runs PR-controlled code with a repo write token. Only comment
+# /approve-snapshots after reviewing the PR's contents — the author_association check below
+# only verifies the commenter, not the safety of the code being run.
 name: E2E approve snapshots
 
 on:
   issue_comment:
     types: [created]
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: write # for stefanzweifel/git-auto-commit-action to push changes
+  pull-requests: write # for thollander/actions-comment-pull-request to comment on PRs
 
 jobs:
   approve_snapshots:
-    if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') }}
+    if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') && contains(fromJSON('["OWNER", "MEMBER"]'), github.event.comment.author_association) }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:

.github/workflows/redeploy-preview.yml

@@ -0,0 +1,45 @@
+# Triggered workflow by PR comment: /redeploy-preview
+#
+# ⚠️ This job checks out and builds PR-controlled code with a Firebase deployment secret.
+# Only comment /redeploy-preview after reviewing the PR's contents — the author_association
+# check below only verifies the commenter, not the safety of the code being built.
+name: Redeploy documentation preview
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  checks: write # for FirebaseExtended/action-hosting-deploy to create a check run
+  contents: read # for actions/checkout to read the repository
+  pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs
+
+jobs:
+  redeploy:
+    if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/redeploy-preview') && contains(fromJSON('["OWNER", "MEMBER"]'), github.event.comment.author_association) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: xt0rted/pull-request-comment-branch@e8b8daa837e8ea7331c0003c9c316a64c6d8b0b1 # v3.0.0
+        id: comment-branch
+      - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+        with:
+          message: 🔄 [Redeploying](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) documentation preview.
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ steps.comment-branch.outputs.head_ref }}
+      - uses: ./.github/workflows/actions/setup-node
+      - uses: ./.github/workflows/actions/build-packages
+      - uses: ./.github/workflows/actions/build-docs
+      - uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0
+        with:
+          repoToken: '${{ secrets.GITHUB_TOKEN }}'
+          firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}'
+          firebaseToolsVersion: '15.3.1'
+          expires: 3d
+          channelId: prs-${{ github.event.issue.number }}
+          projectId: koobiq
+          target: next
+      - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+        if: ${{ failure() }}
+        with:
+          message: 🚨 Failed to [redeploy](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) documentation preview.