Skip to content

Replace pull_request_target in Pages - #43

Merged
ludfjig merged 2 commits into
mainfrom
preview-sync-workflow-run
Nov 10, 2026
Merged

ludfjig merged 2 commits into
mainfrom
preview-sync-workflow-run

Conversation

@ludfjig

@ludfjig ludfjig commented Nov 10, 2026

Copy link
Copy Markdown
Contributor

GitHub blocks pull_request_target in public repositories from December 2, 2026. Pages used it to remove or refresh previews after PR events, and it let outside PRs trigger Pages deployments without approval. One invalid preview build also failed the whole Pages run, which blocked production deploys.

  • Add a no-op PR Preview Sync workflow on those pull_request events. Pages runs through workflow_run when it succeeds and still runs only main code. Fork runs need approval.
  • Skip a preview that fails the build checks or size limit, log a warning, and deploy everything else.

workflow_run only runs from main, so the new chain can only be tested after merge. The old trigger keeps working until then.

GitHub blocks pull_request_target in public repositories from December 2, 2026. Pages used it to remove or refresh previews when a PR closes, becomes a draft, gets a new commit, changes the benchmarks: skip label, or changes base.

A no-op PR Preview Sync workflow now runs on those pull_request events. Pages runs through workflow_run when it succeeds and still executes only main code. Fork runs need approval, so outside PRs can no longer trigger Pages deployments on their own.

Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
One invalid preview build made the whole Pages run fail. Production stopped deploying until that PR closed.

Pages now drops a preview that fails the build checks or exceeds the artifact size limit, logs a warning, and deploys everything else. The warning escapes artifact file names so they cannot inject workflow commands.

Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
@ludfjig
ludfjig force-pushed the preview-sync-workflow-run branch from eeadda8 to 9b33d60 Compare November 10, 2026 18:27
@ludfjig
ludfjig merged commit 2a171d8 into main Nov 10, 2026
22 checks passed

This branch was previously deployed

1 inactive deployment
github-pages — 9b33d603 Deployed Nov 10, 2026 by ludfjig via deploy #426
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant