Skip to content

Commit 0f290b4

Browse files
lucasmerlinlucasmerlin
authored
Add PR preview deployments (#5131)
This adds preview deployments that will deploy a version of egui_demo_app for each pull request, making things easier to review / test. Some notes on security: The preview deployment is split in two workflows, preview_build and preview_deploy. `preview_build` runs on pull_request, so it won't have any access to the repositories secrets, so it is safe to build / execute untrusted code. `preview_deploy` has access to the repositories secrets (so it can push to the pr preview repo) but won't run any untrusted code (it will just extract the build artifact and push it to the pages branch where it will automatically be deployed). To set this up, a DEPLOY_KEY secret needs to be added, which allows the action to push the compiled artifacts into this repository: https://github.com/egui-pr-preview/pr The deploy key is the private key part of a key generated via ssh-keygen. The public key is set as a deploy key in that repo. I have created the repo on a separate github org, so it won't be directly associated with emil or egui in case someone pushes something naughty. I have set this up in my fork of egui to show how this works: - I created a PR: lucasmerlin#2 - The code will be compiled and pushed to the egui-pr-preview/pr repo and deployed via github pages - The bot leaves a comment on the pr with a link to the preview - The preview is available at https://egui-pr-preview.github.io/pr/2-pr-preview-demo/ (It's unfortunately only available a couple seconds after the bot writes the comment, because the pages deployment action is run independently on the other repository) - Once the PR is merged / closed the preview will be cleaned up (unfortunately the empty folder will remain, it seems like it's not possible to remove that via the JamesIves/github-pages-deploy-action action I use, but I don't think that it's a big issue) I'll leave the PR in draft until the DEPLOY_KEY is set up
1 parent 9ba97a9 commit 0f290b4

File tree

4 files changed

+152
-1
lines changed

4 files changed

+152
-1
lines changed

‎.github/workflows/preview_build.yml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# This action builds and deploys egui_demo_app on each pull request created
2+
# Security notes:
3+
# The preview deployment is split in two workflows, preview_build and preview_deploy.
4+
# `preview_build` runs on pull_request, so it won't have any access to the repositories secrets, so it is safe to
5+
# build / execute untrusted code.
6+
# `preview_deploy` has access to the repositories secrets (so it can push to the pr preview repo) but won't run
7+
# any untrusted code (it will just extract the build artifact and push it to the pages branch where it will
8+
# automatically be deployed).
9+
10+
name: Preview Build
11+
12+
on:
13+
- pull_request
14+
15+
jobs:
16+
build:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@v2
20+
- run: rustup toolchain install stable --profile minimal --target wasm32-unknown-unknown
21+
- uses: Swatinem/rust-cache@v2
22+
with:
23+
prefix-key: "pr-preview-"
24+
25+
- name: "Install wasmopt / binaryen"
26+
run: |
27+
sudo apt-get update && sudo apt-get install binaryen
28+
29+
- run: |
30+
scripts/build_demo_web.sh --release
31+
32+
- name: Remove gitignore file
33+
# We need to remove the .gitignore, otherwise the deploy via git will not include the js and wasm files
34+
run: |
35+
rm -rf web_demo/.gitignore
36+
37+
- uses: actions/upload-artifact@v4
38+
with:
39+
name: web_demo
40+
path: web_demo
41+
42+
- name: Generate meta.json
43+
env:
44+
PR_NUMBER: ${{ github.event.number }}
45+
PR_BRANCH: ${{ github.head_ref }}
46+
run: |
47+
echo "{\"pr_number\": \"$PR_NUMBER\", \"pr_branch\": \"$PR_BRANCH\"}" > meta.json
48+
49+
- uses: actions/upload-artifact@v4
50+
with:
51+
name: meta.json
52+
path: meta.json

‎.github/workflows/preview_cleanup.yml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Preview Cleanup
2+
3+
permissions:
4+
contents: write
5+
6+
on:
7+
pull_request_target:
8+
types:
9+
- closed
10+
11+
jobs:
12+
cleanup:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@v4
17+
- run: mkdir -p empty_dir
18+
- name: Url slug variable
19+
run: |
20+
echo "URL_SLUG=${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.ref }}" >> $GITHUB_ENV
21+
- name: Deploy
22+
uses: JamesIves/github-pages-deploy-action@v4
23+
with:
24+
folder: empty_dir
25+
repository-name: egui-pr-preview/pr
26+
branch: 'main'
27+
clean: true
28+
target-folder: ${{ env.URL_SLUG }}
29+
ssh-key: ${{ secrets.DEPLOY_KEY }}
30+
commit-message: "Remove preview for PR ${{ env.URL_SLUG }}"
31+
single-commit: true

‎.github/workflows/preview_deploy.yml

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: Preview Deploy
2+
3+
permissions:
4+
contents: write
5+
pull-requests: write
6+
7+
on:
8+
workflow_run:
9+
workflows:
10+
- "Preview Build"
11+
types:
12+
- completed
13+
14+
# Since we use single_commit and force on the deploy action, only one deploy action can run at a time.
15+
# Should this create a bottleneck we might have to set single_commit and force to false which should allow
16+
# for the deployments to run in parallel.
17+
concurrency:
18+
group: preview_deploy
19+
20+
jobs:
21+
deploy:
22+
runs-on: ubuntu-latest
23+
steps:
24+
- name: Checkout repository
25+
uses: actions/checkout@v4
26+
- name: 'Download build artifact'
27+
uses: actions/download-artifact@v4
28+
with:
29+
name: web_demo
30+
path: web_demo_artifact
31+
github-token: ${{ secrets.GITHUB_TOKEN }}
32+
run-id: ${{ github.event.workflow_run.id }}
33+
- name: 'Download build meta'
34+
uses: actions/download-artifact@v4
35+
with:
36+
name: meta.json
37+
github-token: ${{ secrets.GITHUB_TOKEN }}
38+
run-id: ${{ github.event.workflow_run.id }}
39+
40+
- name: Parse meta.json
41+
run: |
42+
echo "PR_NUMBER=$(jq -r .pr_number meta.json)" >> $GITHUB_ENV
43+
echo "PR_BRANCH=$(jq -r .pr_branch meta.json)" >> $GITHUB_ENV
44+
45+
- name: Url slug variable
46+
run: |
47+
echo "URL_SLUG=${{ env.PR_NUMBER }}-${{ env.PR_BRANCH }}" >> $GITHUB_ENV
48+
49+
- name: Deploy
50+
uses: JamesIves/github-pages-deploy-action@v4
51+
with:
52+
folder: web_demo_artifact
53+
repository-name: egui-pr-preview/pr
54+
branch: 'main'
55+
clean: true
56+
target-folder: ${{ env.URL_SLUG }}
57+
ssh-key: ${{ secrets.DEPLOY_KEY }}
58+
commit-message: "Update preview for PR ${{ env.URL_SLUG }}"
59+
single-commit: true
60+
61+
- name: Comment PR
62+
uses: thollander/actions-comment-pull-request@v2
63+
with:
64+
message: |
65+
Preview available at https://egui-pr-preview.github.io/pr/${{ env.URL_SLUG }}
66+
Note that it might take a couple seconds for the update to show up after the preview_build workflow has completed.
67+
pr_number: ${{ env.PR_NUMBER }}
68+
comment_tag: 'egui-preview'

‎web_demo/index.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@
119119
</script>
120120

121121
<!-- this is the JS generated by the `wasm-bindgen` CLI tool -->
122-
<script src="egui_demo_app.js"></script>
122+
<script src="./egui_demo_app.js"></script>
123123

124124
<script>
125125
// We'll defer our execution until the wasm is ready to go.

0 commit comments

Comments
 (0)