Build the site on pull requests, publish only from main - #24
Merged
Conversation
The Pages workflow triggered on `push` to main and `workflow_dispatch` only, so nothing ran on a pull request: a dependency bump or a content change was mergeable with `total_count: 0` check runs on its head sha, and the first evidence of a mistake would have been a broken published site. "No checks" is not the same thing as green. Add a `pull_request` trigger so the build proves the site still builds, and gate the deploy job on the event so a pull request never publishes. Permissions and concurrency follow from that: `pages: write` and `id-token: write` move down to the deploy job, the only job that needs them, and the concurrency group is scoped by ref so a pull request neither waits behind a deploy nor holds one up. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[2026-08-30 17:51:18 CEST]
The blind spot
The Pages workflow in this repository triggered on
pushtomainandworkflow_dispatchonly. Nothing ran on a pull request, soGET /repos/<owner>/<repo>/commits/<head sha>/check-runsreturnedtotal_count: 0for any pull request opened here. A dependency bump or acontent change was mergeable with nothing verifying it, and the first evidence
of a mistake would have been a broken published site. "No checks" is not the
same thing as green.
The fix
pull_requestis added to the triggers, so the build proves the site stillbuilds before a change lands.
github.event_name != 'pull_request'. A pullrequest stops after the build; it never publishes.
pages: writeandid-token: writemove down to the deploy job, the onlyjob that needs them, so a pull request build cannot publish even if a step in
it misbehaves.
behind a deploy nor holds one up.
How this was found, and how far it goes
Every public repository in all 320 organisations was swept: 1820 public repos,
1453 workflow files read, 573 of them publish to GitHub Pages. 565 already
carry a
pull_requesttrigger with a gated deploy job; this repository was oneof only 8 that did not. The pattern applied here is the one the other 565
already use.
Verified first on go-pdfkit/go-pdfkit.github.io#8, where the head sha went from
total_count: 0to two check runs:buildsuccess,deployskipped.