preview-deploy.yml

The deploy half of the PR-preview family. Triggered on the build workflow’s workflow_run completion, it downloads the artifact and publishes the preview to gh-pages in the base-repo context, then comments the preview link. Keeping it split from the read-only build half is the trust boundary, so untrusted fork code never holds write permissions. The deploy stub’s on: workflow_run: workflows: value must match the build workflow’s name:.

Inputs

This workflow takes no inputs.

Permissions

Grant contents: write (push to gh-pages), pull-requests: write (post the preview-link comment), and actions: read (download the build artifact).

Example

# Copy to .github/workflows/preview-deploy.yml in your repo.
# Deploy half of the PR-preview family: triggered when the build workflow
# finishes, downloads its artifact, and publishes the preview to gh-pages. This
# runs in the BASE-repo context, so its token can write --- keeping it separate
# from the read-only build half is the trust boundary.
#
# NOTE: the `workflows:` value below MUST match the `name:` of your build
# workflow (examples/preview.yml). `workflow_run` triggers only fire when this
# file lives on the default branch.
name: Quarto Preview Deploy

on:
  workflow_run:
    workflows: ["Quarto Preview Build"]
    types: [completed]

jobs:
  deploy:
    permissions:
      contents: write # push to gh-pages
      pull-requests: write # post the preview-link comment
      actions: read # download the build artifact
    uses: Morrison-Lab/gha/.github/workflows/preview-deploy.yml@v2

See examples/preview-deploy.yml for the full caller stub.