mirror of
https://github.com/cloudflare/vinext.git
synced 2026-09-14 19:04:59 +08:00
Steve Faulkner
9a6c8a7ba6
* Skip deploy previews for fork PRs that lack Cloudflare secrets Fork PRs don't have access to repository secrets (CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID), so deploy/smoke-test/comment steps always fail. Add a fork detection condition to skip these steps gracefully. The build steps still run, so example builds are still validated for fork PRs. * Run safe CI for external contributors, add /deploy-preview slash command Switch ci.yml from pull_request to pull_request_target so lint, typecheck, vitest, and e2e run automatically for fork PRs without needing approval. No secrets are used, so this is safe with untrusted code. Add a /deploy-preview slash command workflow that lets maintainers trigger deploy previews on fork PRs. Gated by author_association (org members, collaborators, repo owners only). Cloudflare employees who push branches to the main repo continue to get automatic deploy previews via the existing deploy-examples.yml workflow. * Revert ci.yml to pull_request, skip deploy-examples for fork PRs Simpler approach: keep ci.yml on pull_request (first-time contributor approval is fine, avoids cache poisoning concern with pull_request_target). The actual fix: add a job-level if condition to deploy-examples.yml so the entire workflow is skipped for fork PRs. This prevents the noisy failed/skipped deploy checks on external contributor PRs. Update docs in AGENTS.md and README.md to reflect the approach.