chore: added redeploy preview workflow (#DS-4784) - #191
Merged
Conversation
📝 WalkthroughWalkthroughGitHub Actions workflows now apply explicit permissions and stricter authorization checks. Snapshot approval uses reactions and revised outcome comments, end-to-end testing uses read-only contents access, and a new comment-triggered workflow rebuilds and redeploys documentation previews. ChangesWorkflow controls
Estimated code review effort: 3 (Moderate) | ~25 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant PRComment
participant GitHubActions
participant DocumentationBuild
participant FirebaseHosting
PRComment->>GitHubActions: Create /redeploy-preview comment
GitHubActions->>DocumentationBuild: Checkout PR branch and run setup/build
DocumentationBuild->>FirebaseHosting: Deploy documentation preview
FirebaseHosting-->>GitHubActions: Return deployment result
GitHubActions-->>PRComment: Post success reaction or failure comment
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates GitHub Actions workflows to improve PR feedback/automation around E2E snapshot approvals and preview deployments.
Changes:
- Swap PR comment status updates for GitHub reactions in the E2E snapshot approval workflow, and add a failure comment.
- Tighten preview deploy execution conditions (internal PRs + association allowlist) and shorten Firebase preview expiry.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/e2e-approve-snapshots.yml | Adds reaction-based progress/success signaling and a failure comment for /approve-snapshots runs. |
| .github/workflows/deploy-preview.yml | Restricts when preview deploys run and reduces preview channel lifetime to 3 days. |
|
Visit the preview URL for this PR (updated for commit ffa0eb5): https://data-grid-next--data-grid-pr-191-1nvccqxi.web.app (expires Fri, 17 Jul 2026 12:22:35 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: b9d49913f5b5988e9af8690a8b37f16143707448 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/e2e-approve-snapshots.yml:
- Around line 8-10: Update the workflow permissions and execution flow around
the snapshot-generation job so PR-controlled scripts run without contents:
write. Keep snapshot generation read-only, and isolate any commit/push operation
into a separate trusted step or job that alone receives contents: write while
preserving pull-request commenting permissions where needed.
- Around line 8-10: Update the top-level permissions block in the
e2e-approve-snapshots workflow to include issues: write alongside contents and
pull-requests, preserving the existing permissions and comments.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f0c64417-17eb-4303-96a1-d0122f052820
📒 Files selected for processing (2)
.github/workflows/deploy-preview.yml.github/workflows/e2e-approve-snapshots.yml
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
.github/workflows/redeploy-preview.yml (2)
19-19: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin third-party actions to immutable commit SHAs.
This workflow has write permissions and access to deployment credentials, but its external actions use mutable tags. Pin each third-party action to an audited full-length SHA and update those pins through Dependabot or Renovate.
Also applies to: 21-21, 30-30, 36-36, 45-45, 55-55
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/redeploy-preview.yml at line 19, Update every third-party action in the redeploy preview workflow, including pull-request-comment-branch and the actions at the referenced locations, to use audited full-length immutable commit SHAs instead of mutable version tags. Preserve each action’s current behavior and configure Dependabot or Renovate to maintain the pins.
14-16: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winSerialize redeployments per pull request.
Every run deploys to the same
prs-${{ github.event.issue.number }}channel. Multiple comments can therefore deploy different revisions concurrently, allowing an older build to finish last and leave a stale preview.Suggested fix
permissions: checks: write contents: read issues: write pull-requests: write +concurrency: + group: redeploy-preview-${{ github.event.issue.number }} + cancel-in-progress: true + jobs:Also applies to: 42-42
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/redeploy-preview.yml around lines 14 - 16, Update the redeploy job configuration to serialize runs per pull request by adding a concurrency group keyed by github.event.issue.number, using the existing prs-${{ github.event.issue.number }} channel identifier, and ensure newer redeploy requests cancel any in-progress run so stale revisions cannot finish last.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/redeploy-preview.yml:
- Line 16: Restrict the redeploy-preview trigger condition in the workflow’s
issue-comment job to explicitly trusted maintainers, removing CONTRIBUTOR (and
any other untrusted association) from the allowed author associations before
checking out or executing pull-request code with deployment credentials.
- Around line 36-56: Assign an ID such as deploy to the
FirebaseExtended/action-hosting-deploy step, then update the success reaction
and failure comment conditions to use steps.deploy.outcome instead of job-level
success() or failure(). Keep the existing notification actions and messages
unchanged.
- Around line 30-32: Update the actions/checkout step in the redeploy workflow
to set persist-credentials to false, while preserving the existing head_ref
checkout configuration.
---
Nitpick comments:
In @.github/workflows/redeploy-preview.yml:
- Line 19: Update every third-party action in the redeploy preview workflow,
including pull-request-comment-branch and the actions at the referenced
locations, to use audited full-length immutable commit SHAs instead of mutable
version tags. Preserve each action’s current behavior and configure Dependabot
or Renovate to maintain the pins.
- Around line 14-16: Update the redeploy job configuration to serialize runs per
pull request by adding a concurrency group keyed by github.event.issue.number,
using the existing prs-${{ github.event.issue.number }} channel identifier, and
ensure newer redeploy requests cancel any in-progress run so stale revisions
cannot finish last.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 18324148-bfb5-4d5b-8bf4-3b801b394df4
📒 Files selected for processing (4)
.github/workflows/deploy-preview.yml.github/workflows/e2e-approve-snapshots.yml.github/workflows/e2e.yml.github/workflows/redeploy-preview.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/deploy-preview.yml
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/redeploy-preview.yml (1)
42-60: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winNotifications still keyed off job-level
success()/failure(), not the deploy step outcome.This was flagged previously: if the Firebase deploy step succeeds but the subsequent reaction step fails (or vice versa), the failure comment can misreport a successful deploy as failed. The
FirebaseExtended/action-hosting-deploystep still has noid, and lines 52/62 still use job-levelsuccess()/failure().♻️ Suggested fix
- uses: FirebaseExtended/action-hosting-deploy@v0.11.0 + id: deploy with: repoToken: '${{ secrets.GITHUB_TOKEN }}' firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_KOOBIQ }}' firebaseToolsVersion: ^13.35.1 expires: 3d channelId: data-grid-pr-${{ github.event.issue.number }} projectId: koobiq target: next - uses: actions/github-script@v7 - if: ${{ success() }} + if: ${{ steps.deploy.outcome == 'success' }} with: script: | await github.rest.reactions.createForIssueComment({ owner: context.repo.owner, repo: context.repo.repo, comment_id: context.payload.comment.id, content: 'rocket', }); - uses: thollander/actions-comment-pull-request@v3.0.1 - if: ${{ failure() }} + if: ${{ failure() && steps.deploy.outcome != 'success' }} with: message: 🚨 Failed to [redeploy](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) documentation preview.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/redeploy-preview.yml around lines 42 - 60, Update the FirebaseExtended/action-hosting-deploy step with a unique id, then change the success and failure notification conditions to evaluate that deploy step’s outcome rather than job-level success()/failure(). Keep the reaction steps responsible only for posting the corresponding deploy result.
🧹 Nitpick comments (1)
.github/workflows/redeploy-preview.yml (1)
19-21: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valueConsider adding
timeout-minutesto the job.Comment-triggered builds run untrusted PR code (docs build + install); a hang would consume runner time indefinitely. A conservative timeout bounds this.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/redeploy-preview.yml around lines 19 - 21, Add a conservative timeout-minutes setting to the redeploy job in the redeploy workflow, alongside runs-on, so comment-triggered builds cannot consume runner time indefinitely. Keep the existing job condition and execution behavior unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/redeploy-preview.yml:
- Around line 42-60: Update the FirebaseExtended/action-hosting-deploy step with
a unique id, then change the success and failure notification conditions to
evaluate that deploy step’s outcome rather than job-level success()/failure().
Keep the reaction steps responsible only for posting the corresponding deploy
result.
---
Nitpick comments:
In @.github/workflows/redeploy-preview.yml:
- Around line 19-21: Add a conservative timeout-minutes setting to the redeploy
job in the redeploy workflow, alongside runs-on, so comment-triggered builds
cannot consume runner time indefinitely. Keep the existing job condition and
execution behavior unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: dd200ec2-8d19-48e3-9516-40d35df6540f
📒 Files selected for processing (3)
.github/workflows/deploy-preview.yml.github/workflows/e2e-approve-snapshots.yml.github/workflows/redeploy-preview.yml
🚧 Files skipped from review as they are similar to previous changes (2)
- .github/workflows/deploy-preview.yml
- .github/workflows/e2e-approve-snapshots.yml
This was referenced Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit