preview-build: separate build, deploy, and link index into distinct jobs#2890
Draft
preview-build: separate build, deploy, and link index into distinct jobs#2890
Conversation
Split the monolithic build job into build, deploy, and update-link-index jobs with minimal permissions per job. Move deployment creation and S3 upload out of the build job so fork PRs can still run builds without needing write permissions. Add artifact upload/download to pass build output between jobs. Remove unused free-disk-space input. Split vale reporting into its own job with scoped pull-requests:write permission. Made-with: Cursor
theletterf
approved these changes
Mar 12, 2026
🔍 Preview links for changed docs |
cotti
approved these changes
Mar 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
buildjob into three separate jobs:build,deploy, andupdate-link-index, each with minimal permissionsvale-reportjob to isolatepull-requests: writefrom the build and vale lint jobsfree-disk-spaceinputWhy
deployments: writeandid-token: writeeven for fork PRs that cannot deploy, which grants unnecessary privilegesNotes
actions/upload-artifact/actions/download-artifactdeployjob only runs when the build succeeds and the PR is from the same repositoryMade with Cursor