Surge.sh website preview workflow failing but does not raise error

[scottyhq]

https://github.com/xarray-contrib/xarray-tutorial/actions/runs/9135494118/job/25122893778

I'm guessing the TOKEN from last year just expired at some point. cc @lsetiawan

Might need some minor changes to the workflow (afc163/surge-preview#255)

[lsetiawan]

I'll take a look on Monday. Thanks!

[scottyhq]

I just recalled that I don't think the preview ever worked for PRs coming from forks. Because those workflows have a blank SURGE_TOKEN!

I think it's great to be able to preview content coming from forks. I don't know if there is a better state-of-the art these days, but this is the approach we take for hackweek websites to accomplish this (basically anyone with repo admin permission adds a label to grant access to the token):

https://github.com/uwhackweek/jupyterbook-template/blob/3bddb53b98f0ec234850e9529b241632d7aa6b5e/.github/workflows/netlifypreview.yaml#L4-L18

on:
  pull_request_target:
    types: [labeled, synchronize]

jobs:
  add-preview:
    runs-on: ubuntu-latest
    # This workflow accesses secrets and checks out a PR, so only run if labelled
    # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
    if: contains(github.event.pull_request.labels.*.name, 'preview')

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        ref: ${{ github.event.pull_request.head.sha }}

[scottyhq]

Helpful discussion here about various options:

• distinction between deploying from a branch and deploying from an artifact: Combine with actions/deploy-pages rossjrw/pr-preview-action#21
• possibility to use environment protection for PRs from forks that need secrets Investigate Deployment Reviews as a method of informed consent acquisition rossjrw/pr-preview-action#85

[scottyhq]

I think closed by #260, see afc163/surge-preview#294 and related discussion.

Sometimes the workflow still fails with only a Warning rather than an error code:

Unable to get the PR number with API search: HttpError: You have exceeded a secondary rate limit. Please wait a few minutes before you try again.

Waiting a few minutes and 're-run all jobs' seems to sort things out.