-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add PR preview deployments #5131
Merged
Merged
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,52 @@ | ||
# This action builds and deploys egui_demo_app on each pull request created | ||
# Security notes: | ||
# The preview deployment is split in two workflows, preview_build and preview_deploy. | ||
# `preview_build` runs on pull_request, so it won't have any access to the repositories secrets, so it is safe to | ||
# build / execute untrusted code. | ||
# `preview_deploy` has access to the repositories secrets (so it can push to the pr preview repo) but won't run | ||
# any untrusted code (it will just extract the build artifact and push it to the pages branch where it will | ||
# automatically be deployed). | ||
|
||
name: Preview Build | ||
|
||
on: | ||
- pull_request | ||
|
||
jobs: | ||
build: | ||
runs-on: ubuntu-latest | ||
steps: | ||
- uses: actions/checkout@v2 | ||
- run: rustup toolchain install stable --profile minimal --target wasm32-unknown-unknown | ||
- uses: Swatinem/rust-cache@v2 | ||
with: | ||
prefix-key: "pr-preview-" | ||
|
||
- name: "Install wasmopt / binaryen" | ||
run: | | ||
sudo apt-get update && sudo apt-get install binaryen | ||
|
||
- run: | | ||
scripts/build_demo_web.sh --release | ||
|
||
- name: Remove gitignore file | ||
# We need to remove the .gitignore, otherwise the deploy via git will not include the js and wasm files | ||
run: | | ||
rm -rf web_demo/.gitignore | ||
|
||
- uses: actions/upload-artifact@v4 | ||
with: | ||
name: web_demo | ||
path: web_demo | ||
|
||
- name: Generate meta.json | ||
env: | ||
PR_NUMBER: ${{ github.event.number }} | ||
PR_BRANCH: ${{ github.head_ref }} | ||
run: | | ||
echo "{\"pr_number\": \"$PR_NUMBER\", \"pr_branch\": \"$PR_BRANCH\"}" > meta.json | ||
|
||
- uses: actions/upload-artifact@v4 | ||
with: | ||
name: meta.json | ||
path: meta.json |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,31 @@ | ||
name: Preview Cleanup | ||
|
||
permissions: | ||
contents: write | ||
|
||
on: | ||
pull_request_target: | ||
types: | ||
- closed | ||
|
||
jobs: | ||
cleanup: | ||
runs-on: ubuntu-latest | ||
steps: | ||
- name: Checkout repository | ||
uses: actions/checkout@v4 | ||
- run: mkdir -p empty_dir | ||
- name: Url slug variable | ||
run: | | ||
echo "URL_SLUG=${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.ref }}" >> $GITHUB_ENV | ||
- name: Deploy | ||
uses: JamesIves/github-pages-deploy-action@v4 | ||
with: | ||
folder: empty_dir | ||
repository-name: egui-pr-preview/pr | ||
branch: 'main' | ||
clean: true | ||
target-folder: ${{ env.URL_SLUG }} | ||
ssh-key: ${{ secrets.DEPLOY_KEY }} | ||
commit-message: "Remove preview for PR ${{ env.URL_SLUG }}" | ||
single-commit: true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,68 @@ | ||
name: Preview Deploy | ||
|
||
permissions: | ||
contents: write | ||
pull-requests: write | ||
|
||
on: | ||
workflow_run: | ||
workflows: | ||
- "Preview Build" | ||
types: | ||
- completed | ||
|
||
# Since we use single_commit and force on the deploy action, only one deploy action can run at a time. | ||
# Should this create a bottleneck we might have to set single_commit and force to false which should allow | ||
# for the deployments to run in parallel. | ||
concurrency: | ||
group: preview_deploy | ||
|
||
jobs: | ||
deploy: | ||
runs-on: ubuntu-latest | ||
steps: | ||
- name: Checkout repository | ||
uses: actions/checkout@v4 | ||
- name: 'Download build artifact' | ||
uses: actions/download-artifact@v4 | ||
with: | ||
name: web_demo | ||
path: web_demo_artifact | ||
github-token: ${{ secrets.GITHUB_TOKEN }} | ||
run-id: ${{ github.event.workflow_run.id }} | ||
- name: 'Download build meta' | ||
uses: actions/download-artifact@v4 | ||
with: | ||
name: meta.json | ||
github-token: ${{ secrets.GITHUB_TOKEN }} | ||
run-id: ${{ github.event.workflow_run.id }} | ||
|
||
- name: Parse meta.json | ||
run: | | ||
echo "PR_NUMBER=$(jq -r .pr_number meta.json)" >> $GITHUB_ENV | ||
echo "PR_BRANCH=$(jq -r .pr_branch meta.json)" >> $GITHUB_ENV | ||
|
||
- name: Url slug variable | ||
run: | | ||
echo "URL_SLUG=${{ env.PR_NUMBER }}-${{ env.PR_BRANCH }}" >> $GITHUB_ENV | ||
|
||
- name: Deploy | ||
uses: JamesIves/github-pages-deploy-action@v4 | ||
with: | ||
folder: web_demo_artifact | ||
repository-name: egui-pr-preview/pr | ||
branch: 'main' | ||
clean: true | ||
target-folder: ${{ env.URL_SLUG }} | ||
ssh-key: ${{ secrets.DEPLOY_KEY }} | ||
commit-message: "Update preview for PR ${{ env.URL_SLUG }}" | ||
single-commit: true | ||
|
||
- name: Comment PR | ||
uses: thollander/actions-comment-pull-request@v2 | ||
with: | ||
message: | | ||
Preview available at https://egui-pr-preview.github.io/pr/${{ env.URL_SLUG }} | ||
Note that it might take a couple seconds for the update to show up after the preview_build workflow has completed. | ||
pr_number: ${{ env.PR_NUMBER }} | ||
comment_tag: 'egui-preview' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Very nice!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
…but I guess it doesn't prevent a malicious user from simply changing the
.yml
in the PR.But there should be some way to configure it so that it is always the
.yml
frommaster
that is run? 🤔There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The pull_request trigger will run workflows from the pr branch, so yes, they could modify the yml. But the workflow won't get any access to secrets and will only get a read only GITHUB_TOKEN, so it wouldn't be a problem.
Worst thing they could do is change the output to meta.json to point at a different branch and overwrite someone elses preview deployment that way 🤔
It's possible to run the workflow from master via pull_request_target but then it would be unsafe to build the untrusted code since workflows using that have access to secrets.