[wiki] Fix branch-protection publishing flow (#48)

.github/workflows/wiki.yml

@@ -3,31 +3,39 @@
 on:
   workflow_call:
   workflow_dispatch:
-  push:
-    branches: ["main"]
+  pull_request:
+    types: [opened, synchronize, reopened]
+  pull_request_target:
+    types: [closed]
 
 permissions:
   contents: write
-  pull-requests: write
+  pull-requests: read
 
 concurrency:
-  group: update-wiki-${{ github.ref }}
+  group: update-wiki-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
-  wiki:
-    name: Update Wiki
+  preview:
+    name: Update Wiki Preview
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
 
+    env:
+      WIKI_PREVIEW_BRANCH: pr-${{ github.event.pull_request.number }}
+
     steps:
-      - name: Checkout repository
+      - name: Checkout PR branch
         uses: actions/checkout@v6
         with:
           token: ${{ github.token }}
+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
           submodules: recursive
           fetch-depth: 0
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
           php-version: '8.3'
@@ -49,32 +57,39 @@
         env:
           COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ github.token }}"} }'
           COMPOSER_CACHE_DIR: /tmp/composer-cache
-          COMPOSER_ROOT_VERSION: dev-main
+          COMPOSER_ROOT_VERSION: dev-${{ github.event.pull_request.head.ref }}
         run: composer install --prefer-dist --no-progress --no-interaction --no-scripts
 
-      - name: Prepare wiki submodule branch
+      - name: Prepare wiki preview branch
         working-directory: .github/wiki
         run: |
-          git fetch origin master
-          git switch -C master --track origin/master || git switch master
-          git reset --hard origin/master
+          git fetch origin
+
+          if git ls-remote --exit-code --heads origin "${WIKI_PREVIEW_BRANCH}" >/dev/null 2>&1; then
+            git switch -C "${WIKI_PREVIEW_BRANCH}" --track "origin/${WIKI_PREVIEW_BRANCH}"
+            git reset --hard "origin/${WIKI_PREVIEW_BRANCH}"
+          else
+            git switch --orphan "${WIKI_PREVIEW_BRANCH}"
+            git rm -rf . >/dev/null 2>&1 || true
+            find . -mindepth 1 -maxdepth 1 ! -name '.git' -exec rm -rf {} +
+          fi
+
           git clean -fd
 
       - name: Create Docs Markdown
         env:
-          COMPOSER_ROOT_VERSION: dev-main
+          COMPOSER_ROOT_VERSION: dev-${{ github.event.pull_request.head.ref }}
         run: composer dev-tools wiki -- --target=.github/wiki
 
-      - name: Commit & push wiki submodule
+      - name: Commit & push wiki preview branch
         id: wiki_commit
         uses: EndBug/add-and-commit@v10
         with:
           cwd: .github/wiki
           add: .
-          message: "Update wiki docs"
+          message: "Update wiki docs for PR #${{ github.event.pull_request.number }}"
           default_author: github_actions
-          pull: "--rebase --autostash"
-          push: true
+          push: origin HEAD:${{ env.WIKI_PREVIEW_BRANCH }}
 
       - name: Check submodule pointer changes
         id: submodule_status
@@ -85,19 +100,52 @@
             echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Create or update pull request for wiki submodule pointer
+      - name: Commit parent repo submodule pointer
         if: steps.submodule_status.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@v7
+        id: parent_commit
+        uses: EndBug/add-and-commit@v10
+        with:
+          add: .github/wiki
+          message: "Update wiki submodule pointer for PR #${{ github.event.pull_request.number }}"
+          default_author: github_actions
+          pull: "--rebase --autostash"
+          push: true
+
+  publish:
+    name: Publish Wiki Main
+    if: github.event_name == 'pull_request_target' && github.event.pull_request.merged == true && github.event.pull_request.base.ref == 'main'
+    runs-on: ubuntu-latest
+
+    env:
+      WIKI_PREVIEW_BRANCH: pr-${{ github.event.pull_request.number }}
+
+    steps:
+      - name: Checkout main branch
+        uses: actions/checkout@v6
         with:
           token: ${{ github.token }}
-          branch: chore/update-wiki-submodule-pointer
-          base: main
-          title: "Update wiki submodule pointer"
-          body: |
-            This PR updates the repository submodule pointer for `.github/wiki` to match the latest wiki revision generated by the workflow.
-          commit-message: "Update wiki submodule pointer"
-          author: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
-          committer: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
-          add-paths: |
-            .github/wiki
-          delete-branch: true
+          ref: main
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Mark workspace as safe for git
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git config --global --add safe.directory "$GITHUB_WORKSPACE/.github/wiki"
+
+      - name: Prepare wiki main branch from preview branch
+        working-directory: .github/wiki
+        run: |
+          git fetch origin main "${WIKI_PREVIEW_BRANCH}"
+          git switch -C main --track origin/main || git switch main
+          git reset --hard "origin/${WIKI_PREVIEW_BRANCH}"
+          git clean -fd
+
+      - name: Commit & push wiki main branch
+        uses: EndBug/add-and-commit@v10
+        with:
+          cwd: .github/wiki
+          add: .
+          message: "Publish wiki docs from PR #${{ github.event.pull_request.number }}"
+          default_author: github_actions
+          push: origin HEAD:main

resources/github-actions/wiki.yml

@@ -1,15 +1,19 @@
 name: "Fast Forward Wiki Update"
 
 on:
-  push:
-    branches:
-      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+  pull_request_target:
+    types: [closed]
   workflow_dispatch:
 
 permissions:
   contents: write
-  pages: write
-  id-token: write
+  pull-requests: read
+
+concurrency:
+  group: fast-forward-wiki-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   wiki: