Build the landing page on pull requests, publish only from main - #8
Merged
Conversation
The Pages workflow triggered on `push` to main and `workflow_dispatch` only, so nothing ran on a pull request. Measured, not assumed: the two open Renovate pull requests here (#6 bumping actions/configure-pages, #7 bumping actions/deploy-pages) both report `total_count: 0` from `/repos/go-pdfkit/go-pdfkit.github.io/commits/<sha>/check-runs`. A change to the very workflow that publishes the site was mergeable with nothing verifying it, and the first evidence of a mistake would have been a broken published site. Add a `pull_request` trigger so the build job proves the site still builds, and gate the deploy job on the event so a pull request never publishes. Permissions and concurrency follow from that: - the workflow now grants `contents: read` and `pages: read` only. `pages: write` and `id-token: write` move down to the deploy job, which is the only job that needs them; a pull request build therefore cannot publish even if a step in it misbehaves. `configure-pages` runs in the build job and reads the Pages settings to compute the base URL, which `pages: read` covers. - the concurrency group is scoped by ref. Deploys still serialise with one another under the main group, while each pull request gets a group of its own so it neither waits behind a deploy nor holds one up, and a new push to the same pull request supersedes the build still running for it. The action versions are deliberately left alone: pull requests #6 and #7 exist to bump them, and they are now the proof that the check actually appears. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 30, 2026
Merged
This was referenced Aug 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[2026-08-30 17:48:26 CEST]
The blind spot
.github/workflows/deploy-pages.ymltriggered onpushtomainandworkflow_dispatchonly. Nothing ran on a pull request.Measured, not assumed. For the two open Renovate pull requests here, #6
(
actions/configure-pagesv5 to v6) and #7 (actions/deploy-pagesv4 to v5),GET /repos/go-pdfkit/go-pdfkit.github.io/commits/<head sha>/check-runsreturns
total_count: 0for both.So a change to the very workflow that publishes this site was mergeable with
nothing verifying it, and the first evidence of a mistake would have been a
broken published site. "No checks" is not the same thing as green.
The fix
pull_requestis added to the triggers, so thebuildjob proves the sitestill builds before a change lands.
deployis gated ongithub.event_name != 'pull_request'. A pull requeststops after the build; it never publishes.
pages: writeandid-token: writemove down to thedeployjob, the onlyjob that needs them. The workflow now grants
contents: readandpages: read, which is whatconfigure-pagesneeds in the build job to readthe Pages settings and compute the base URL. A pull request build therefore
cannot publish even if a step in it misbehaves.
another under the main group; each pull request gets a group of its own, so
it neither waits behind a deploy nor holds one up, and a new push to the same
pull request supersedes the build still running for it.
Action versions are deliberately untouched. #6 and #7 exist to bump them, and
once this lands they become the proof that the check actually appears.
Fleet context
Every public repository in all 320 organisations was swept: 1820 public repos,
1453 workflow files read, 573 of them publish to GitHub Pages. 565 already
carry a
pull_requesttrigger with a gated deploy job. This repository was oneof only 8 that did not.