draft

Author: DarianM

.github/scripts/check-deploy-permissions.js

@@ -0,0 +1,63 @@
+// @ts-check
+
+/**
+ * @typedef {Schemas['webhook-pull-request-opened']} PullRequest
+ */
+
+/**
+ * Check if the current GitHub event should trigger a deployment
+ * @param {object} params
+ * @param {object} params.core - GitHub Actions core utilities
+ * @param {object} params.context - GitHub Actions context
+ */
+module.exports = async ({ core, context }) => {
+
+  // check if author is authorized
+  if (context.eventName === 'pull_request') {
+    const event = /** @type {PullRequest} */ (context.payload);
+    const authorAssociation = event.pull_request.author_association;
+
+    if (!isAllowedAuthor(authorAssociation)) {
+      await skipDeployment(core, 'The PR author is not authorized to run deployments.');
+      return;
+    }
+
+    core.setOutput('should-deploy', 'true');
+    core.info('Deployment allowed: Authorized contributor');
+    return;
+  }
+
+  // no deployment for other events
+  core.setOutput('should-deploy', 'false');
+  core.info('Deployment not triggered for this event type');
+};
+
+/**
+ * Check if the author association allows deployment
+ * @param {string} authorAssociation - The author's association with the repository
+ * @returns {boolean} Whether the author is allowed to deploy
+ */
+function isAllowedAuthor(authorAssociation) {
+  return (
+    authorAssociation === 'OWNER' ||
+    authorAssociation === 'MEMBER' ||
+    authorAssociation === 'COLLABORATOR'
+  );
+}
+
+/**
+ * Skip deployment and set appropriate outputs
+ * @param {object} core - GitHub Actions core utilities
+ * @param {string} reason - Reason for skipping deployment
+ */
+async function skipDeployment(core, reason) {
+  core.info('Skipping deployment for security reasons.');
+  core.setOutput('should-deploy', 'false');
+  await core.summary
+    .addQuote(`🚫 Deployment skipped: ${reason}`)
+    .addDetails(
+      'Security Notice',
+      'Deployments are restricted to organization members, collaborators, and repository owners for security reasons. External contributors can still run builds and tests.'
+    )
+    .write();
+}

.github/workflows/deploy.yml

@@ -20,7 +20,29 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+      
+      - name: Check deployment permissions
+        id: deploy-check
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const script = require('./.github/scripts/check-deploy-permissions.js');
+            await script({ core, context });
+      
       - uses: ./.github/workflows/setup
+      
+      # Build and test steps (always run for validation)
+      - name: Build API (validation)
+        if: steps.deploy-check.outputs.should-deploy == 'false'
+        run: pnpm -C api run build
+        
+      - name: Build CDN (validation)
+        if: steps.deploy-check.outputs.should-deploy == 'false'
+        run: pnpm -C cdn run build
+        
+      - name: Build Frontend (validation)
+        if: steps.deploy-check.outputs.should-deploy == 'false'
+        run: pnpm -C frontend run build
       - name: Install wrangler globally
         # The wrangler Action expects a global installation, so we better reuse
         # what we've in our project.
@@ -74,6 +96,7 @@ jobs:
       # 3. frontend
 
       - name: Deploy API
+        if: steps.deploy-check.outputs.should-deploy == 'true'
         uses: ./.github/workflows/deploy-worker
         id: api
         with:
@@ -87,6 +110,7 @@ jobs:
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
 
       - name: Deploy CDN
+        if: steps.deploy-check.outputs.should-deploy == 'true'
         uses: ./.github/workflows/deploy-worker
         id: cdn
         with:
@@ -102,6 +126,7 @@ jobs:
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
 
       - name: Deploy Frontend
+        if: steps.deploy-check.outputs.should-deploy == 'true'
         uses: ./.github/workflows/deploy-worker
         id: frontend
         with: