Add GitHub Actions workflow for drafting PDF - #15
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow to automatically build a JOSS draft PDF from paper.md and upload it as a workflow artifact.
Changes:
- Introduces a new workflow (
Draft PDF) triggered on push. - Uses
openjournals/openjournals-draft-actionto compilepaper.mdintopaper.pdf. - Uploads the generated PDF via
actions/upload-artifact.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - name: Build draft PDF | ||
| uses: openjournals/openjournals-draft-action@master |
There was a problem hiding this comment.
openjournals/openjournals-draft-action@master is unpinned and may change/break unexpectedly (and increases supply-chain risk). Pin this action to a version tag or (preferably) a commit SHA, similar to how other actions are referenced with stable versions in this repo.
| uses: openjournals/openjournals-draft-action@master | |
| uses: openjournals/openjournals-draft-action@v1 |
| @@ -0,0 +1,24 @@ | |||
| name: Draft PDF | |||
| on: [push] | |||
|
|
|||
There was a problem hiding this comment.
This workflow doesn’t declare explicit permissions, so it will rely on the repository/org default token permissions. Other workflows in this repo set least-privilege permissions explicitly (e.g., .github/workflows/python-publish.yml:15-17). Consider adding a top-level permissions: contents: read (and any additional scopes strictly required) for consistency and to avoid accidental privilege escalation if defaults change.
| permissions: | |
| contents: read |
| @@ -0,0 +1,24 @@ | |||
| name: Draft PDF | |||
| on: [push] | |||
There was a problem hiding this comment.
on: [push] will run this PDF build on every push to every branch, including changes unrelated to the paper, which can add unnecessary CI load. Consider scoping the trigger (e.g., push on main and/or paths limited to paper.md/paper.bib, and optionally pull_request/workflow_dispatch), similar to .github/workflows/codeql.yml:14-18 using branch filters.
| on: [push] | |
| on: | |
| push: | |
| paths: | |
| - paper.md | |
| - paper.bib | |
| - .github/workflows/draft-pdf.yml | |
| workflow_dispatch: |
No description provided.