From 95a5808ae681544683f51812fa8c8104100a4f13 Mon Sep 17 00:00:00 2001 From: Artem Belik Date: Tue, 14 Jul 2026 13:03:38 +0300 Subject: [PATCH 1/5] chore: added redeploy preview workflow (#DS-4784) --- .github/workflows/deploy-preview.yml | 13 ++++----- .github/workflows/e2e-approve-snapshots.yml | 31 ++++++++++++++++----- 2 files changed, 29 insertions(+), 15 deletions(-) diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml index 4603178..86cb41c 100644 --- a/.github/workflows/deploy-preview.yml +++ b/.github/workflows/deploy-preview.yml @@ -2,18 +2,15 @@ name: Deploy preview on: pull_request: - branches: - - main - workflow_dispatch: permissions: - checks: write - contents: read - pull-requests: write + checks: write # for FirebaseExtended/action-hosting-deploy to create a check run + contents: read # for actions/checkout to read the repository + pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs jobs: deploy: - if: ${{ github.actor != 'dependabot[bot]' }} + if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository && contains(fromJSON('["OWNER", "MEMBER", "CONTRIBUTOR"]'), github.event.pull_request.author_association) }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 @@ -26,6 +23,6 @@ jobs: repoToken: ${{ secrets.GITHUB_TOKEN }} firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }} firebaseToolsVersion: ^13.35.1 - expires: 5d + expires: 3d target: next channelId: data-grid-pr-${{ github.event.number }} diff --git a/.github/workflows/e2e-approve-snapshots.yml b/.github/workflows/e2e-approve-snapshots.yml index da4c207..0d1e2c0 100644 --- a/.github/workflows/e2e-approve-snapshots.yml +++ b/.github/workflows/e2e-approve-snapshots.yml @@ -1,3 +1,4 @@ +# Triggered workflow by PR comment: /approve-snapshots name: E2E approve snapshots on: @@ -5,8 +6,8 @@ on: types: [created] permissions: - contents: write - pull-requests: write + contents: write # for stefanzweifel/git-auto-commit-action to push changes + pull-requests: write # for thollander/actions-comment-pull-request to comment on PRs jobs: approve_snapshots: @@ -16,23 +17,39 @@ jobs: steps: - uses: xt0rted/pull-request-comment-branch@v3 id: comment-branch + - uses: actions/github-script@v7 + with: + script: | + await github.rest.reactions.createForIssueComment({ + owner: context.repo.owner, + repo: context.repo.repo, + comment_id: context.payload.comment.id, + content: 'eyes', + }); - uses: actions/checkout@v7 with: ref: ${{ steps.comment-branch.outputs.head_ref }} - - uses: thollander/actions-comment-pull-request@v3 - with: - message: 🔄 [Updating](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) snapshots. - run: npm run e2e:docker:update-snapshots - uses: stefanzweifel/git-auto-commit-action@v7 id: commit-and-push with: commit_message: 'test: updated e2e snapshots' file_pattern: '**/*.png **/*.txt' - - uses: thollander/actions-comment-pull-request@v3 + - uses: actions/github-script@v7 if: ${{ steps.commit-and-push.outputs.changes_detected == 'true' }} with: - message: ✅ Snapshots [updated](https://github.com/${{ github.repository }}/pull/${{ github.event.issue.number }}/commits/${{ steps.commit-and-push.outputs.commit_hash }})! + script: | + await github.rest.reactions.createForIssueComment({ + owner: context.repo.owner, + repo: context.repo.repo, + comment_id: context.payload.comment.id, + content: 'rocket', + }); - uses: thollander/actions-comment-pull-request@v3 if: ${{ steps.commit-and-push.outputs.changes_detected != 'true' }} with: message: ⚠️ No snapshots changes detected. + - uses: thollander/actions-comment-pull-request@v3 + if: ${{ failure() }} + with: + message: 🚨 Failed to [update](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) snapshots. From 1c693b52f555da8edc7e2d3ece88d3ec5d9896dc Mon Sep 17 00:00:00 2001 From: Artem Belik Date: Tue, 14 Jul 2026 13:37:42 +0300 Subject: [PATCH 2/5] refactor: review --- .github/workflows/deploy-preview.yml | 2 +- .github/workflows/e2e-approve-snapshots.yml | 3 +- .github/workflows/e2e.yml | 4 +- .github/workflows/redeploy-preview.yml | 58 +++++++++++++++++++++ 4 files changed, 63 insertions(+), 4 deletions(-) create mode 100644 .github/workflows/redeploy-preview.yml diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml index 86cb41c..37d328b 100644 --- a/.github/workflows/deploy-preview.yml +++ b/.github/workflows/deploy-preview.yml @@ -10,7 +10,7 @@ permissions: jobs: deploy: - if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository && contains(fromJSON('["OWNER", "MEMBER", "CONTRIBUTOR"]'), github.event.pull_request.author_association) }} + if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR", "CONTRIBUTOR"]'), github.event.pull_request.author_association) }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 diff --git a/.github/workflows/e2e-approve-snapshots.yml b/.github/workflows/e2e-approve-snapshots.yml index 0d1e2c0..699cbd4 100644 --- a/.github/workflows/e2e-approve-snapshots.yml +++ b/.github/workflows/e2e-approve-snapshots.yml @@ -7,11 +7,12 @@ on: permissions: contents: write # for stefanzweifel/git-auto-commit-action to push changes + issues: write # for actions/github-script to react to the triggering comment pull-requests: write # for thollander/actions-comment-pull-request to comment on PRs jobs: approve_snapshots: - if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') }} + if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') && contains(fromJSON('["OWNER", "MEMBER", "CONTRIBUTOR"]'), github.event.comment.author_association) }} runs-on: ubuntu-24.04-arm timeout-minutes: 10 steps: diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 84d4625..0719b72 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -7,8 +7,8 @@ on: pull_request: permissions: - contents: write - pull-requests: write + contents: read # for actions/checkout to read the repository + pull-requests: write # for thollander/actions-comment-pull-request to comment on PRs jobs: tests: diff --git a/.github/workflows/redeploy-preview.yml b/.github/workflows/redeploy-preview.yml new file mode 100644 index 0000000..eb9d88e --- /dev/null +++ b/.github/workflows/redeploy-preview.yml @@ -0,0 +1,58 @@ +# Triggered workflow by PR comment: /redeploy-preview +name: Redeploy documentation preview + +on: + issue_comment: + types: [created] + +permissions: + checks: write # for FirebaseExtended/action-hosting-deploy to create a check run + contents: read # for actions/checkout to read the repository + issues: write # for actions/github-script to react to the triggering comment + pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs + +jobs: + redeploy: + if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/redeploy-preview') && contains(fromJSON('["OWNER", "MEMBER", "CONTRIBUTOR"]'), github.event.comment.author_association) }} + runs-on: ubuntu-latest + steps: + - uses: xt0rted/pull-request-comment-branch@v3 + id: comment-branch + - uses: actions/github-script@v7 + with: + script: | + await github.rest.reactions.createForIssueComment({ + owner: context.repo.owner, + repo: context.repo.repo, + comment_id: context.payload.comment.id, + content: 'eyes', + }); + - uses: actions/checkout@v7 + with: + ref: ${{ steps.comment-branch.outputs.head_ref }} + - uses: ./.github/workflows/actions/setup-node + - uses: ./.github/workflows/actions/build-packages + - uses: ./.github/workflows/actions/build-docs + - uses: FirebaseExtended/action-hosting-deploy@v0.11.0 + with: + repoToken: '${{ secrets.GITHUB_TOKEN }}' + firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}' + firebaseToolsVersion: ^13.35.1 + expires: 3d + channelId: prs-${{ github.event.issue.number }} + projectId: koobiq + target: next + - uses: actions/github-script@v7 + if: ${{ success() }} + with: + script: | + await github.rest.reactions.createForIssueComment({ + owner: context.repo.owner, + repo: context.repo.repo, + comment_id: context.payload.comment.id, + content: 'rocket', + }); + - uses: thollander/actions-comment-pull-request@v3.0.1 + if: ${{ failure() }} + with: + message: 🚨 Failed to [redeploy](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) documentation preview. From e1df839dfd8134123b7dcb15a1ee7e1b457c4727 Mon Sep 17 00:00:00 2001 From: Artem Belik Date: Tue, 14 Jul 2026 14:12:13 +0300 Subject: [PATCH 3/5] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/redeploy-preview.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/redeploy-preview.yml b/.github/workflows/redeploy-preview.yml index eb9d88e..2e43024 100644 --- a/.github/workflows/redeploy-preview.yml +++ b/.github/workflows/redeploy-preview.yml @@ -30,9 +30,10 @@ jobs: - uses: actions/checkout@v7 with: ref: ${{ steps.comment-branch.outputs.head_ref }} - - uses: ./.github/workflows/actions/setup-node - - uses: ./.github/workflows/actions/build-packages - - uses: ./.github/workflows/actions/build-docs + - uses: ./.github/actions/setup-node + # Run dev mode build to generate the `e2eRoute` + # @see dev/ag-grid-angular/src/main.ts + - run: yarn run build --configuration=development - uses: FirebaseExtended/action-hosting-deploy@v0.11.0 with: repoToken: '${{ secrets.GITHUB_TOKEN }}' From 5a08c87dc9040b8e41b189bc3f22bded65d89237 Mon Sep 17 00:00:00 2001 From: Artem Belik Date: Tue, 14 Jul 2026 14:13:18 +0300 Subject: [PATCH 4/5] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/redeploy-preview.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/redeploy-preview.yml b/.github/workflows/redeploy-preview.yml index 2e43024..694265f 100644 --- a/.github/workflows/redeploy-preview.yml +++ b/.github/workflows/redeploy-preview.yml @@ -40,7 +40,7 @@ jobs: firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}' firebaseToolsVersion: ^13.35.1 expires: 3d - channelId: prs-${{ github.event.issue.number }} + channelId: data-grid-pr-${{ github.event.issue.number }} projectId: koobiq target: next - uses: actions/github-script@v7 From ffa0eb5a478d80477bddff31011bd01e23d0e7e7 Mon Sep 17 00:00:00 2001 From: Artem Belik Date: Tue, 14 Jul 2026 15:19:02 +0300 Subject: [PATCH 5/5] refactor: review --- .github/workflows/deploy-preview.yml | 4 +++- .github/workflows/e2e-approve-snapshots.yml | 6 +++++- .github/workflows/redeploy-preview.yml | 7 ++++++- 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml index 37d328b..2305ffc 100644 --- a/.github/workflows/deploy-preview.yml +++ b/.github/workflows/deploy-preview.yml @@ -10,10 +10,12 @@ permissions: jobs: deploy: - if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR", "CONTRIBUTOR"]'), github.event.pull_request.author_association) }} + if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository && contains(fromJSON('["OWNER", "MEMBER", "CONTRIBUTOR"]'), github.event.pull_request.author_association) }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: ./.github/actions/setup-node # Run dev mode build to generate the `e2eRoute` # @see dev/ag-grid-angular/src/main.ts diff --git a/.github/workflows/e2e-approve-snapshots.yml b/.github/workflows/e2e-approve-snapshots.yml index 699cbd4..d398dcb 100644 --- a/.github/workflows/e2e-approve-snapshots.yml +++ b/.github/workflows/e2e-approve-snapshots.yml @@ -1,4 +1,8 @@ # Triggered workflow by PR comment: /approve-snapshots +# +# ⚠️ This job checks out and runs PR-controlled code with a repo write token. Only comment +# /approve-snapshots after reviewing the PR's contents — the author_association check below +# only verifies the commenter, not the safety of the code being run. name: E2E approve snapshots on: @@ -12,7 +16,7 @@ permissions: jobs: approve_snapshots: - if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') && contains(fromJSON('["OWNER", "MEMBER", "CONTRIBUTOR"]'), github.event.comment.author_association) }} + if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') && contains(fromJSON('["OWNER", "MEMBER"]'), github.event.comment.author_association) }} runs-on: ubuntu-24.04-arm timeout-minutes: 10 steps: diff --git a/.github/workflows/redeploy-preview.yml b/.github/workflows/redeploy-preview.yml index 694265f..3efa164 100644 --- a/.github/workflows/redeploy-preview.yml +++ b/.github/workflows/redeploy-preview.yml @@ -1,4 +1,8 @@ # Triggered workflow by PR comment: /redeploy-preview +# +# ⚠️ This job checks out and builds PR-controlled code with a Firebase deployment secret. +# Only comment /redeploy-preview after reviewing the PR's contents — the author_association +# check below only verifies the commenter, not the safety of the code being built. name: Redeploy documentation preview on: @@ -13,7 +17,7 @@ permissions: jobs: redeploy: - if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/redeploy-preview') && contains(fromJSON('["OWNER", "MEMBER", "CONTRIBUTOR"]'), github.event.comment.author_association) }} + if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/redeploy-preview') && contains(fromJSON('["OWNER", "MEMBER"]'), github.event.comment.author_association) }} runs-on: ubuntu-latest steps: - uses: xt0rted/pull-request-comment-branch@v3 @@ -30,6 +34,7 @@ jobs: - uses: actions/checkout@v7 with: ref: ${{ steps.comment-branch.outputs.head_ref }} + persist-credentials: false - uses: ./.github/actions/setup-node # Run dev mode build to generate the `e2eRoute` # @see dev/ag-grid-angular/src/main.ts