Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Website previews for fork PRs need a workflow_run deployment on a trusted branch

Ouverte
  • Quelque chose ne va pas ?
#890 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
25/100
Type d'issue
Fonctionnalité
Clarté
Plutôt claire
Activité
Active
Stack technique
github-actions, typescript
Domaine
ci-cd

Piste de recherche

Start by reading deploy-website-preview.yml and the related constraints in #888 and #889. Resolve the artifact-lifetime, PR-commenting, and fork-preview questions before choosing the pull_request/workflow_run design. Done means a safe, documented decision and a preview path that never executes fork code with deployment secrets.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

A pull_request run from a fork receives no repository secrets — GitHub withholds them from code the PR author controls, regardless of the permissions: block or the environment configuration. So deploy-website-preview.yml cannot deploy a preview for a fork PR at all, and #888 makes it skip with a notice rather than fail at wrangler deploy.

That leaves fork contributors — the more likely contributor in an open-source relay — with no preview, which is exactly the case a site change most needs one for.

What it needs

The standard shape is a two-workflow split:

  1. pull_request (unprivileged) builds the site, uploads the built tree as an artifact, and writes nothing else.
  2. workflow_run on a trusted branch reads that artifact and deploys it with the secrets available to main.

The security-critical property is that the deploying job never executes fork code: it unpacks a static build, which is data, rather than checking out and running the PR's package.json, build scripts or wrangler config. Even then, the deployed content is attacker-controlled — which is precisely why previews must stay on their own domain and out of the production one (#889 enforces that host boundary in the router).

Open questions worth settling before building it

  • does the artifact path survive PR deletion between the two runs
  • how to comment on the PR from a workflow_run context, which has no pull_request payload (the run's associated_pull_requests is the route, and it can be empty)
  • whether a preview worker should be created for a fork at all, or the build published as an artifact link only

Found while fixing review findings on #888; not attempted there, because improvising a privileged deploy path inside a bug fix is how a supply-chain hole gets shipped.

Langage dominant
TypeScript
Étoiles
829
Forks
234
Merge moyen
18 h 18 min
PR mergées (30 j)
69

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de cameri/nostream

Toutes les issues de cameri/nostream

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.