[TEST] Update: 公式ドキュメントにしっかり従ってみる

.github/workflows/esbuild-bundle-analyzer.yml

@@ -1,21 +1,25 @@
 name: ESBuild Bundle Analyzer
 
-on: [pull_request]
-
-permissions:
-  contents: read # for checkout repository
-  actions: read # for fetching base branch bundle stats
-  pull-requests: write # for comments
+on: [pull_request_target]
 
 jobs:
-  build:
+  # PLEASE AVOID ADDING OTHER JOBS IN THIS FILE
+  # BECAUSE THIS ACTION USE `pull_request_target` EVENT that grants write permissions to GitHub Actions running on PRs from forks.
+  analyze:
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read # for checkout repository
+      actions: read # for fetching base branch bundle stats
+      pull-requests: write # for comments
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+        with:
+          # This is required to fetch the commit SHA of the forked PR
+          ref: "${{ github.event.pull_request.merge_commit_sha }}"
+      - uses: actions/setup-node@v4
         with:
-          node-version: "18"
+          node-version: 18
           cache: "yarn"
       - name: Install Dependencies
         run: yarn workspaces focus --all --production
@@ -27,4 +31,4 @@ jobs:
         # uses: exoego/esbuild-bundle-analyzer@main # If you prefer nightly!
         uses: exoego/esbuild-bundle-analyzer@v1
         with:
-          metafiles: "meta.json"
+          metafiles: "out/meta.json"

package.json

@@ -44,7 +44,7 @@
     "lint:stylelint:fix": "yarn run lint:stylelint --fix",
     "lint:markuplint": "markuplint \"app/views/**/*.html.erb\" \"public/*.html\"",
     "build": "esbuild app/javascript/*.* --bundle --sourcemap --define:global=window --outdir=app/assets/builds",
-    "build:metafile": "esbuild app/javascript/*.* --bundle --metafile=meta.json --outdir=app/assets/builds",
+    "build:metafile": "esbuild app/javascript/*.* --bundle --metafile=out/meta.json --outdir=app/assets/builds",
     "build:css": "sass ./app/assets/stylesheets/:./app/assets/builds/ --no-source-map --load-path=node_modules"
   },
   "packageManager": "yarn@4.0.2"