Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add PR preview deployments #5131

Merged
merged 2 commits into from
Sep 20, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 52 additions & 0 deletions .github/workflows/preview_build.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
# This action builds and deploys egui_demo_app on each pull request created
# Security notes:
# The preview deployment is split in two workflows, preview_build and preview_deploy.
# `preview_build` runs on pull_request, so it won't have any access to the repositories secrets, so it is safe to
# build / execute untrusted code.
# `preview_deploy` has access to the repositories secrets (so it can push to the pr preview repo) but won't run
# any untrusted code (it will just extract the build artifact and push it to the pages branch where it will
# automatically be deployed).
Comment on lines +6 to +8
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Very nice!

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

…but I guess it doesn't prevent a malicious user from simply changing the .yml in the PR.

But there should be some way to configure it so that it is always the .yml from master that is run? 🤔

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull_request trigger will run workflows from the pr branch, so yes, they could modify the yml. But the workflow won't get any access to secrets and will only get a read only GITHUB_TOKEN, so it wouldn't be a problem.

Worst thing they could do is change the output to meta.json to point at a different branch and overwrite someone elses preview deployment that way 🤔

It's possible to run the workflow from master via pull_request_target but then it would be unsafe to build the untrusted code since workflows using that have access to secrets.


name: Preview Build

on:
- pull_request

jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- run: rustup toolchain install stable --profile minimal --target wasm32-unknown-unknown
- uses: Swatinem/rust-cache@v2
with:
prefix-key: "pr-preview-"

- name: "Install wasmopt / binaryen"
run: |
sudo apt-get update && sudo apt-get install binaryen

- run: |
scripts/build_demo_web.sh --release

- name: Remove gitignore file
# We need to remove the .gitignore, otherwise the deploy via git will not include the js and wasm files
run: |
rm -rf web_demo/.gitignore

- uses: actions/upload-artifact@v4
with:
name: web_demo
path: web_demo

- name: Generate meta.json
env:
PR_NUMBER: ${{ github.event.number }}
PR_BRANCH: ${{ github.head_ref }}
run: |
echo "{\"pr_number\": \"$PR_NUMBER\", \"pr_branch\": \"$PR_BRANCH\"}" > meta.json

- uses: actions/upload-artifact@v4
with:
name: meta.json
path: meta.json
31 changes: 31 additions & 0 deletions .github/workflows/preview_cleanup.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
name: Preview Cleanup

permissions:
contents: write

on:
pull_request_target:
types:
- closed

jobs:
cleanup:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- run: mkdir -p empty_dir
- name: Url slug variable
run: |
echo "URL_SLUG=${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.ref }}" >> $GITHUB_ENV
- name: Deploy
uses: JamesIves/github-pages-deploy-action@v4
with:
folder: empty_dir
repository-name: egui-pr-preview/pr
branch: 'main'
clean: true
target-folder: ${{ env.URL_SLUG }}
ssh-key: ${{ secrets.DEPLOY_KEY }}
commit-message: "Remove preview for PR ${{ env.URL_SLUG }}"
single-commit: true
68 changes: 68 additions & 0 deletions .github/workflows/preview_deploy.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
name: Preview Deploy

permissions:
contents: write
pull-requests: write

on:
workflow_run:
workflows:
- "Preview Build"
types:
- completed

# Since we use single_commit and force on the deploy action, only one deploy action can run at a time.
# Should this create a bottleneck we might have to set single_commit and force to false which should allow
# for the deployments to run in parallel.
concurrency:
group: preview_deploy

jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: 'Download build artifact'
uses: actions/download-artifact@v4
with:
name: web_demo
path: web_demo_artifact
github-token: ${{ secrets.GITHUB_TOKEN }}
run-id: ${{ github.event.workflow_run.id }}
- name: 'Download build meta'
uses: actions/download-artifact@v4
with:
name: meta.json
github-token: ${{ secrets.GITHUB_TOKEN }}
run-id: ${{ github.event.workflow_run.id }}

- name: Parse meta.json
run: |
echo "PR_NUMBER=$(jq -r .pr_number meta.json)" >> $GITHUB_ENV
echo "PR_BRANCH=$(jq -r .pr_branch meta.json)" >> $GITHUB_ENV

- name: Url slug variable
run: |
echo "URL_SLUG=${{ env.PR_NUMBER }}-${{ env.PR_BRANCH }}" >> $GITHUB_ENV

- name: Deploy
uses: JamesIves/github-pages-deploy-action@v4
with:
folder: web_demo_artifact
repository-name: egui-pr-preview/pr
branch: 'main'
clean: true
target-folder: ${{ env.URL_SLUG }}
ssh-key: ${{ secrets.DEPLOY_KEY }}
commit-message: "Update preview for PR ${{ env.URL_SLUG }}"
single-commit: true

- name: Comment PR
uses: thollander/actions-comment-pull-request@v2
with:
message: |
Preview available at https://egui-pr-preview.github.io/pr/${{ env.URL_SLUG }}
Note that it might take a couple seconds for the update to show up after the preview_build workflow has completed.
pr_number: ${{ env.PR_NUMBER }}
comment_tag: 'egui-preview'
2 changes: 1 addition & 1 deletion web_demo/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@
</script>

<!-- this is the JS generated by the `wasm-bindgen` CLI tool -->
<script src="egui_demo_app.js"></script>
<script src="./egui_demo_app.js"></script>

<script>
// We'll defer our execution until the wasm is ready to go.
Expand Down
Loading