From 690b87ada5d6139d87f7d8e7819f4179e6d496cf Mon Sep 17 00:00:00 2001 From: moran Date: Sun, 24 May 2026 14:08:56 +0300 Subject: [PATCH 1/2] Add GitHub Actions for PR preview and release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - preview.yml: runs `wix preview` on PR open/sync, posts URL as a sticky comment on the PR (skips fork PRs). - release.yml: runs `wix release` on push to main. - Both build first, login via WIX_CLI_TOKEN, and pull Wix env via `wix env pull` before build. - No third-party actions used — org policy blocks them. Uses raw git, pre-installed Node 20, and the `gh` CLI for PR comments. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/preview.yml | 74 +++++++++++++++++++++++++++++++++++ .github/workflows/release.yml | 46 ++++++++++++++++++++++ 2 files changed, 120 insertions(+) create mode 100644 .github/workflows/preview.yml create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml new file mode 100644 index 0000000..a14c3f9 --- /dev/null +++ b/.github/workflows/preview.yml @@ -0,0 +1,74 @@ +name: PR Preview + +on: + pull_request: + types: [opened, reopened, synchronize] + +concurrency: + group: preview-${{ github.event.pull_request.number }} + cancel-in-progress: true + +permissions: + contents: read + pull-requests: write + +jobs: + preview: + # Skip PRs from forks — they don't get secrets and would fail at wix login. + if: github.event.pull_request.head.repo.full_name == github.repository + runs-on: ubuntu-latest + steps: + - name: Checkout PR head + env: + GH_TOKEN: ${{ github.token }} + PR_SHA: ${{ github.event.pull_request.head.sha }} + run: | + git init -q . + git remote add origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" + git fetch --depth=1 origin "$PR_SHA" + git checkout -q FETCH_HEAD + + - name: Install dependencies + run: npm ci + + - name: Wix login + env: + WIX_CLI_TOKEN: ${{ secrets.WIX_CLI_TOKEN }} + run: npx wix login --api-key "$WIX_CLI_TOKEN" + + - name: Pull Wix env + run: npx wix env pull + + - name: Build + run: npx wix build + + - name: Create preview deployment + id: preview + run: | + set -o pipefail + npx wix preview 2>&1 | tee preview.log + url="$(grep -Eoi 'https?://[^[:space:]]+' preview.log | tail -n1)" + if [ -z "$url" ]; then + echo "Could not parse a preview URL from wix preview output." >&2 + exit 1 + fi + echo "url=$url" >> "$GITHUB_OUTPUT" + + - name: Comment preview URL on PR + env: + GH_TOKEN: ${{ github.token }} + PR_NUMBER: ${{ github.event.pull_request.number }} + PR_SHA: ${{ github.event.pull_request.head.sha }} + PREVIEW_URL: ${{ steps.preview.outputs.url }} + run: | + marker='' + body=$(printf '%s\n**Preview deployment ready** for commit `%s`\n\n%s\n' "$marker" "$PR_SHA" "$PREVIEW_URL") + existing_id=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --paginate \ + --jq ".[] | select(.body | contains(\"$marker\")) | .id" | head -n1) + if [ -n "$existing_id" ]; then + jq -n --arg body "$body" '{body: $body}' \ + | gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$existing_id" --input - + else + jq -n --arg body "$body" '{body: $body}' \ + | gh api --method POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --input - + fi diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..fd31a96 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,46 @@ +name: Release + +on: + push: + branches: [main] + +concurrency: + group: release-main + cancel-in-progress: false + +permissions: + contents: read + +jobs: + release: + runs-on: ubuntu-latest + steps: + - name: Checkout + env: + GH_TOKEN: ${{ github.token }} + run: | + git init -q . + git remote add origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" + git fetch --depth=1 origin "$GITHUB_SHA" + git checkout -q FETCH_HEAD + + - name: Install dependencies + run: npm ci + + - name: Wix login + env: + WIX_CLI_TOKEN: ${{ secrets.WIX_CLI_TOKEN }} + run: npx wix login --api-key "$WIX_CLI_TOKEN" + + - name: Pull Wix env + run: npx wix env pull + + - name: Build + run: npx wix build + + - name: Release + env: + COMMIT_MSG: ${{ github.event.head_commit.message }} + run: | + subject="$(printf '%s' "$COMMIT_MSG" | head -n1)" + npx wix release -c "$subject" From eec741b39aad122eda0acc02c08c009ed7f07d42 Mon Sep 17 00:00:00 2001 From: moran Date: Sun, 24 May 2026 14:23:34 +0300 Subject: [PATCH 2/2] Add debug step: whoami and visible sites Temporary diagnostic to confirm which Wix account the API key is issued for and which sites it can see. Helps narrow down whether the env-pull permission failure is an account/site mismatch. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/preview.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index a14c3f9..1e78e75 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -36,6 +36,19 @@ jobs: WIX_CLI_TOKEN: ${{ secrets.WIX_CLI_TOKEN }} run: npx wix login --api-key "$WIX_CLI_TOKEN" + - name: Debug — whoami + visible sites + env: + WIX_CLI_TOKEN: ${{ secrets.WIX_CLI_TOKEN }} + run: | + echo "=== wix whoami ===" + npx wix whoami || true + echo + echo "=== Sites visible to this API key ===" + curl -sS -X POST https://www.wixapis.com/site-list/v2/sites/query \ + -H "Authorization: $WIX_CLI_TOKEN" \ + -H "Content-Type: application/json" \ + -d '{"query":{}}' | jq '.sites[]? | {id, displayName: .displayName, ownerEmail: .owner.email}' + - name: Pull Wix env run: npx wix env pull