fix(ci): tighten PR workflow permissions and secret access (#901)

Author: robdecker

.github/workflows/next-drupal.yml

@@ -3,27 +3,51 @@ on:
   push:
     branches:
       - main
-  pull_request_target:
-    types: [opened, reopened, synchronize]
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
-      # TODO: Work-around for failing code coverage.
-      # https://github.com/chapter-three/next-drupal/issues/740
+          persist-credentials: false
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
           node-version: '18.19.x'
       - name: Install packages
-        run: yarn
-      - name: Run tests
-        run: yarn test
+        run: yarn install --frozen-lockfile
+      - name: Run unit tests (PR)
+        if: github.event_name == 'pull_request'
+        # Skip integration test files that exercise a live Drupal instance.
+        # Tracking removal of the live dependency in .claude/plans/.
+        run: |
+          yarn workspace next-drupal test \
+            --testPathIgnorePatterns="NextDrupal/(crud-methods|resource-methods|basic-methods)|NextDrupalPages/(resource-methods|pages-router-methods)" \
+            --coverageThreshold='{}'
+        env:
+          # Placeholders only — unit tests mock fetch. The test utils
+          # construct a Drupal client at module load and require these
+          # to be present (not valid).
+          DRUPAL_BASE_URL: http://localhost
+          DRUPAL_USERNAME: test
+          DRUPAL_PASSWORD: test
+          DRUPAL_CLIENT_ID: test
+          DRUPAL_CLIENT_SECRET: test
+      - name: Run all tests (main)
+        if: github.event_name == 'push'
+        run: yarn workspace next-drupal test
         env:
           DRUPAL_BASE_URL: ${{ secrets.DRUPAL_BASE_URL }}
           DRUPAL_USERNAME: ${{ secrets.DRUPAL_USERNAME }}

.github/workflows/release-pr.yml

@@ -1,24 +1,37 @@
 name: release-pr
 on:
   pull_request:
-    types: [opened, reopened, synchronize, labeled]
+    types: [labeled]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number }}
+  cancel-in-progress: true
 
 jobs:
   next-drupal:
     runs-on: ubuntu-latest
-    if: ${{ contains(github.event.pull_request.labels.*.name, format('release-pr{0} next-drupal', ':')) }}
+    timeout-minutes: 15
+    if: |
+      contains(github.event.pull_request.labels.*.name, format('release-pr{0} next-drupal', ':')) &&
+      github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name
     environment: Preview
     steps:
       - name: Init
         uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20
+          registry-url: https://registry.npmjs.org/
       - name: Install dependencies
-        run: yarn install
+        run: yarn install --frozen-lockfile
       - name: Determine version
         uses: ./.github/version-pr
         id: determine-version
@@ -27,18 +40,22 @@ jobs:
       - name: Publish to npm
         run: |
           cd packages/next-drupal
-          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> .npmrc
           yarn publish --no-git-checks --access public --tag experimental
         env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
       - name: Comment version on PR
-        uses: NejcZdovc/comment-pr@v2
-        with:
-          message:
-            "🎉 Experimental release [published 📦️ on npm](https://npmjs.com/package/next-drupal/v/${{ env.VERSION }})!\n \
-            ```sh\npnpm add next-drupal@${{ env.VERSION }}\n```\n \
-            ```sh\nyarn add next-drupal@${{ env.VERSION }}\n```\n \
-            ```sh\nnpm i next-drupal@${{ env.VERSION }}\n```"
         env:
           VERSION: ${{ steps.determine-version.outputs.version }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.number }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr comment "$PR_NUMBER" --body "🎉 Experimental release [published 📦️ on npm](https://npmjs.com/package/next-drupal/v/$VERSION)!
+          \`\`\`sh
+          pnpm add next-drupal@$VERSION
+          \`\`\`
+          \`\`\`sh
+          yarn add next-drupal@$VERSION
+          \`\`\`
+          \`\`\`sh
+          npm i next-drupal@$VERSION
+          \`\`\`"