Skip AWS auth in docs preview when docs build fails

[Mpdreamz]

Why

The docs preview workflow could still run the aws-auth step when the local documentation build had not succeeded, which requests OIDC and configures AWS credentials unnecessarily and can be confusing when debugging failed builds.

What

The aws-auth step conditions are aligned with the Upload to S3 step: AWS authentication only runs when the build completed successfully (not skipped), MATCH applies, and path-prefix validation succeeded, so credential setup matches the cases where we actually sync to S3.

Made with Cursor

[coderabbitai]

📝 Walkthrough

Walkthrough

The change tightens the execution conditions for a step in the build job of the docs-preview-local workflow. It extends the conditional gate to require both env.MATCH == 'true' and !cancelled(), while also explicitly ensuring that two prior steps—internal-docs-build and internal-validate-path-prefixes—both completed successfully before allowing the downstream step to proceed. This prevents execution when either prerequisite validation fails.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding a condition to skip AWS authentication when the docs build fails.
Description check	✅ Passed	The description clearly explains the problem (unnecessary AWS auth when build fails) and the solution (aligning aws-auth conditions with Upload to S3 step).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/local-docs-build

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/docs-preview-local.yml (1)

329-352: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

aws-auth is stricter than Upload to S3, creating a credential gap.

The PR objective is to align aws-auth with the Upload to S3 conditions, but the new condition is actually more restrictive: aws-auth requires steps.internal-validate-path-prefixes.outcome == 'success' while Upload to S3 does not.

When internal-docs-build succeeds but internal-validate-path-prefixes fails:

• aws-auth → skipped (credentials never configured)
• Upload to S3 → runs (its if is satisfied) → fails with an AWS auth error

To fix the asymmetry, either add the path-prefix check to the S3 step (if uploading without a valid prefix is undesirable) or drop it from aws-auth:

🐛 Option A — guard S3 upload with the same path-prefix requirement

      - name: Upload to S3
        id: s3-upload
        if: >
          env.MATCH == 'true'
          && !cancelled()
          && steps.internal-docs-build.outputs.skip != 'true'
          && steps.internal-docs-build.outcome == 'success'
+         && steps.internal-validate-path-prefixes.outcome == 'success'

🐛 Option B — remove the path-prefix gate from aws-auth to match S3 exactly

      - uses: elastic/docs-builder/.github/actions/aws-auth@main
        if: >
          env.MATCH == 'true'
          && !cancelled()
          && needs.check.outputs.any_modified != 'false'
          && steps.internal-docs-build.outputs.skip != 'true'
          && steps.internal-docs-build.outcome == 'success'
-         && steps.internal-validate-path-prefixes.outcome == 'success'

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docs-preview-local.yml around lines 329 - 352, The
aws-auth action is gated by steps.internal-validate-path-prefixes.outcome ==
'success' while the "Upload to S3" step is not, causing an auth gap; fix by
making the condition logic symmetric: either add the same path-prefix check to
the Upload to S3 step's if (include &&
steps.internal-validate-path-prefixes.outcome == 'success') so it only runs when
prefixes validate, or remove the path-prefix requirement from the aws-auth
action's if so it matches the Upload to S3 step; update the conditional on the
aws-auth invocation or the s3-upload step respectively (referencing aws-auth,
the "Upload to S3" step/id s3-upload, and steps.internal-validate-path-prefixes)
to ensure both steps have identical guards.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/docs-preview-local.yml:
- Around line 329-352: The aws-auth action is gated by
steps.internal-validate-path-prefixes.outcome == 'success' while the "Upload to
S3" step is not, causing an auth gap; fix by making the condition logic
symmetric: either add the same path-prefix check to the Upload to S3 step's if
(include && steps.internal-validate-path-prefixes.outcome == 'success') so it
only runs when prefixes validate, or remove the path-prefix requirement from the
aws-auth action's if so it matches the Upload to S3 step; update the conditional
on the aws-auth invocation or the s3-upload step respectively (referencing
aws-auth, the "Upload to S3" step/id s3-upload, and
steps.internal-validate-path-prefixes) to ensure both steps have identical
guards.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 839c7736-f326-4725-8afd-f781a8359aef

📥 Commits

Reviewing files that changed from the base of the PR and between 7c12eb6 and 501fdb9.

📒 Files selected for processing (1)

• .github/workflows/docs-preview-local.yml