Surge.sh website preview workflow failing but does not raise error

scottyhq commented 4 months ago

https://github.com/xarray-contrib/xarray-tutorial/actions/runs/9135494118/job/25122893778

I'm guessing the TOKEN from last year just expired at some point. cc @lsetiawan

Might need some minor changes to the workflow (https://github.com/afc163/surge-preview/issues/255)

lsetiawan commented 4 months ago

I'll take a look on Monday. Thanks!

scottyhq commented 4 months ago

I just recalled that I don't think the preview ever worked for PRs coming from forks. Because those workflows have a blank SURGE_TOKEN!

I think it's great to be able to preview content coming from forks. I don't know if there is a better state-of-the art these days, but this is the approach we take for hackweek websites to accomplish this (basically anyone with repo admin permission adds a label to grant access to the token):

https://github.com/uwhackweek/jupyterbook-template/blob/3bddb53b98f0ec234850e9529b241632d7aa6b5e/.github/workflows/netlifypreview.yaml#L4-L18

on:
  pull_request_target:
    types: [labeled, synchronize]

jobs:
  add-preview:
    runs-on: ubuntu-latest
    # This workflow accesses secrets and checks out a PR, so only run if labelled
    # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
    if: contains(github.event.pull_request.labels.*.name, 'preview')

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        ref: ${{ github.event.pull_request.head.sha }}

scottyhq commented 4 months ago

Helpful discussion here about various options:

distinction between deploying from a branch and deploying from an artifact: https://github.com/rossjrw/pr-preview-action/issues/21
possibility to use environment protection for PRs from forks that need secrets https://github.com/rossjrw/pr-preview-action/issues/85

scottyhq commented 3 months ago

I think closed by #260, see https://github.com/afc163/surge-preview/pull/294 and related discussion.

Sometimes the workflow still fails with only a Warning rather than an error code:

Unable to get the PR number with API search: HttpError: You have exceeded a secondary rate limit. Please wait a few minutes before you try again.

Waiting a few minutes and 're-run all jobs' seems to sort things out.

xarray-contrib / xarray-tutorial

Surge.sh website preview workflow failing but does not raise error #259