fix(CI): split documentation workflow to avoid pull_request_target checkout block

.github/workflows/documentation-deploy.yml

@@ -0,0 +1,82 @@
+name: Documentation deploy
+on:
+  workflow_run:
+    workflows: [Documentation]
+    types: [completed]
+permissions:
+  actions: read
+  contents: read
+  pull-requests: read
+jobs:
+  deploy:
+    name: Deploy
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
+    env:
+      SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }}
+      SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
+      GH_PR_TOKEN: ${{ secrets.GH_PR_TOKEN }}
+    steps:
+      - name: Check out project
+        uses: actions/checkout@v4
+
+      - name: Set up project
+        uses: ./.github/actions/setup-project
+        with:
+          skip-build: true
+
+      - name: Resolve PR number
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+          REPOSITORY: ${{ github.repository }}
+          WORKFLOW_PRS: ${{ toJSON(github.event.workflow_run.pull_requests) }}
+        run: |
+          set -euo pipefail
+          PR_COUNT=$(jq 'length // 0' <<< "${WORKFLOW_PRS:-null}")
+          if [ "$PR_COUNT" -eq 1 ]; then
+            PR_NUM=$(jq -r '.[0].number' <<< "$WORKFLOW_PRS")
+          elif [ "$PR_COUNT" -eq 0 ]; then
+            if ! [[ "$HEAD_SHA" =~ ^[0-9a-fA-F]{40,64}$ ]]; then
+              echo "Invalid source workflow head SHA"
+              exit 1
+            fi
+            PR_JSON=$(gh api --paginate "repos/${REPOSITORY}/commits/${HEAD_SHA}/pulls")
+            PR_COUNT=$(jq 'length // 0' <<< "$PR_JSON")
+            if [ "$PR_COUNT" -ne 1 ]; then
+              echo "Failed to uniquely resolve PR number for commit ${HEAD_SHA} (found ${PR_COUNT} pull requests)"
+              exit 1
+            fi
+            PR_NUM=$(jq -r '.[0].number' <<< "$PR_JSON")
+          else
+            echo "Ambiguous PR metadata: found ${PR_COUNT} pull requests on the source workflow run"
+            exit 1
+          fi
+          if ! [[ "$PR_NUM" =~ ^[0-9]+$ ]]; then
+            echo "Failed to resolve a valid PR number"
+            exit 1
+          fi
+          echo "GH_PR_NUM=$PR_NUM" >> "$GITHUB_ENV"
+
+      - name: Download documentation
+        uses: actions/download-artifact@v4
+        with:
+          name: documentation
+          path: packages/react-docs/public
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Download a11y coverage
+        uses: actions/download-artifact@v4
+        with:
+          name: a11y-coverage
+          path: packages/react-docs/coverage
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload documentation
+        run: node .github/upload-preview.mjs packages/react-docs/public
+
+      - name: Upload accessibility results
+        if: ${{ !cancelled() }}
+        run: node .github/upload-preview.mjs packages/react-docs/coverage

.github/workflows/documentation.yml

@@ -1,6 +1,6 @@
 name: Documentation
 on:
-  pull_request_target:
+  pull_request:
   issue_comment:
     types: [created]
   workflow_call:
@@ -19,6 +19,7 @@ on:
         required: true
 jobs:
   check-permissions:
+    if: github.event_name == 'issue_comment'
     uses: patternfly/.github/.github/workflows/check-team-membership.yml@fdb52a63a2220ec8a3b6c2d43f312cda708ffa06
     secrets: inherit
 
@@ -27,39 +28,51 @@ jobs:
     runs-on: ubuntu-latest
     needs: check-permissions
     if: >-
-      always() &&
-      !cancelled() &&
-      (inputs.is-release || needs.check-permissions.outputs.allowed == 'true')
+      ${{ !cancelled() &&
+      (inputs.is-release || github.event_name != 'issue_comment' || needs.check-permissions.outputs.allowed == 'true') }}
     env:
       SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }}
       SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
       GH_PR_TOKEN: ${{ secrets.GH_PR_TOKEN }}
       GH_PR_NUM: ${{ needs.check-permissions.outputs.pr-number }}
     steps:
       - name: Check out project from PR branch
-        if: github.event_name == 'pull_request_target' || github.event_name == 'issue_comment'
+        if: github.event_name == 'issue_comment'
         uses: actions/checkout@v4
         with:
-          # Checkout the merge commit so that we can access the PR's changes.
-          # This is nessesary because `pull_request_target` checks out the base branch (e.g. `main`) by default.
           ref: refs/pull/${{ env.GH_PR_NUM }}/head
 
       - name: Check out project
-        if: inputs.is-release || github.event_name == 'workflow_call'
+        if: github.event_name != 'issue_comment'
         uses: actions/checkout@v4
+
       - name: Set up and build project
         uses: ./.github/actions/setup-project
 
       - name: Build documentation
         run: yarn build:docs
 
-      - name: Upload documentation
-        if: always()
+      - name: Upload documentation preview
+        if: ${{ !cancelled() && github.event_name != 'pull_request' }}
         run: node .github/upload-preview.mjs packages/react-docs/public
 
       - name: Run accessibility tests
         run: yarn serve:docs & yarn test:a11y
 
       - name: Upload accessibility results
-        if: always()
+        if: ${{ !cancelled() && github.event_name != 'pull_request' }}
         run: node .github/upload-preview.mjs packages/react-docs/coverage
+
+      - name: Upload docs artifact
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v4
+        with:
+          name: documentation
+          path: packages/react-docs/public
+
+      - name: Upload a11y artifact
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v4
+        with:
+          name: a11y-coverage
+          path: packages/react-docs/coverage