kandev/.github/workflows/preview-env.yml

name: Preview Environment

# Dual triggers — mirrors the claude-code-review.yml pattern exactly:
#   pull_request: same-repo PRs (secrets available, safe to run on PR head)
#   pull_request_target: fork PRs (secrets available via base repo, gated by allowlist)
# Exactly one job runs per PR event based on event_name AND head repo identity.
on:
  pull_request:
    types: [opened, synchronize, reopened, closed]
  pull_request_target:
    # `labeled` is needed so a maintainer applying `safe-to-review` to a fork PR
    # triggers a deploy against the current head SHA. Subsequent fork pushes
    # (synchronize) re-use the maintainer's approval for the new head.
    types: [opened, synchronize, reopened, closed, labeled]

concurrency:
  group: preview-env-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
  # Don't cancel cleanup on close — let it finish destroying the sprite.
  cancel-in-progress: ${{ github.event.action != 'closed' }}

jobs:
  # -----------------------------------------------------------------------
  # Deploy / update preview (same-repo PRs)
  # Always runs for same-repo pushes that are not a close event.
  # -----------------------------------------------------------------------
  deploy-same-repo:
    if: >
      github.event.action != 'closed' &&
      github.event_name == 'pull_request' &&
      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: apps/backend/go.mod
          cache-dependency-path: apps/backend/go.sum

      - uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5
        with:
          version: "9.15.9"

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "24"

      - name: Install frontend dependencies
        run: pnpm -C apps install --frozen-lockfile

      - name: Deploy preview environment
        working-directory: apps/backend
        run: go run ./cmd/preview deploy --pr "$PR" --sha "$SHA" --repo "$REPO" --skip-web-install
        env:
          PR: ${{ github.event.pull_request.number }}
          SHA: ${{ github.event.pull_request.head.sha }}
          REPO: ${{ github.repository }}
          SPRITES_API_TOKEN: ${{ secrets.SPRITES_API_TOKEN }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # -----------------------------------------------------------------------
  # Deploy / update preview (fork PRs, gated by allowlist)
  # Uses pull_request_target so secrets are available.
  # Three approval paths:
  #   - PREVIEW_ENV_ALLOWLIST repo variable (trusted login list, all events;
  #     JSON array of logins)
  #   - CLAUDE_REVIEW_ALLOWLIST repo variable (trusted login list, all events;
  #     the Claude workflow also adds the approval labels on open)
  #   - `safe-to-review` label (maintainer opt-in, durable until removed). It
  #     authorizes the current and subsequent fork heads. This matters more
  #     here than for claude-code-review.yml because deploy actually runs the
  #     fork's `cmd/preview` code with SPRITES_API_TOKEN.
  # -----------------------------------------------------------------------
  # Branch order matters: keep cheap/safe checks before `fromJSON(vars.*)`,
  # which throws (and skips the whole job) if the repo variable is
  # non-empty but unparseable JSON.
  deploy-fork:
    if: >
      github.event.action != 'closed' &&
      github.event_name == 'pull_request_target' &&
      github.event.pull_request.head.repo.full_name != github.repository &&
      ((contains(github.event.pull_request.labels.*.name, 'safe-to-review')) ||
       (vars.PREVIEW_ENV_ALLOWLIST != '' && contains(fromJSON(vars.PREVIEW_ENV_ALLOWLIST), github.event.pull_request.user.login)) ||
       (vars.CLAUDE_REVIEW_ALLOWLIST != '' && contains(fromJSON(vars.CLAUDE_REVIEW_ALLOWLIST), github.event.pull_request.user.login)))
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          # pull_request_target checks out base by default; explicitly use PR head.
          # Safe: the preview CLI only reads files to build artifacts and posts comments.
          # NOTE: The allowlist gate (safe-to-review, PREVIEW_ENV_ALLOWLIST,
          # CLAUDE_REVIEW_ALLOWLIST)
          # authorizes running the fork's cmd/preview code with SPRITES_API_TOKEN and GH_TOKEN.
          # The safe-to-review label remains an explicit maintainer approval for
          # follow-up pushes until the maintainer removes it.
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: apps/backend/go.mod
          cache-dependency-path: apps/backend/go.sum

      - uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5
        with:
          version: "9.15.9"

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "24"

      - name: Install frontend dependencies
        run: pnpm -C apps install --frozen-lockfile

      - name: Deploy preview environment
        working-directory: apps/backend
        run: go run ./cmd/preview deploy --pr "$PR" --sha "$SHA" --repo "$REPO" --skip-web-install
        env:
          PR: ${{ github.event.pull_request.number }}
          SHA: ${{ github.event.pull_request.head.sha }}
          REPO: ${{ github.repository }}
          SPRITES_API_TOKEN: ${{ secrets.SPRITES_API_TOKEN }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # -----------------------------------------------------------------------
  # Cleanup (all closed PRs — no allowlist check)
  # The sprite must be destroyed regardless of how the PR was closed or
  # whether a preview was ever successfully deployed. Handles gracefully
  # if the sprite does not exist (was never deployed or already destroyed).
  # Runs only on pull_request_target to avoid duplicate runs — both events
  # fire `closed`, but only pull_request_target has secrets for all PRs.
  # -----------------------------------------------------------------------
  cleanup-preview:
    if: >
      github.event.action == 'closed' &&
      github.event_name == 'pull_request_target'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: apps/backend/go.mod
          cache-dependency-path: apps/backend/go.sum

      - name: Destroy preview environment
        working-directory: apps/backend
        run: go run ./cmd/preview cleanup --pr "$PR" --repo "$REPO"
        env:
          PR: ${{ github.event.pull_request.number }}
          REPO: ${{ github.repository }}
          SPRITES_API_TOKEN: ${{ secrets.SPRITES_API_TOKEN }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}