Harden Cloudflare preview deployments

.github/workflows/preview.yaml

@@ -28,11 +28,13 @@ defaults:
     shell: bash -o errexit -o pipefail -o nounset -o errtrace {0}
 
 jobs:
-  preview:
+  prepare:
     permissions:
-      pull-requests: write
+      actions: read
     runs-on: ubuntu-latest
-    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository
+    outputs:
+      pr_number: ${{ github.event.workflow_run.pull_requests[0].number }}
     steps:
       - name: Download pull request artifact
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -44,7 +46,9 @@ jobs:
                run_id: ${{ github.event.workflow_run.id }},
             });
             const downloads = await Promise.all(
-              artifacts.data.artifacts.map(a => github.rest.actions.downloadArtifact({
+              artifacts.data.artifacts
+                .filter(a => a.name === 'website')
+                .map(a => github.rest.actions.downloadArtifact({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 artifact_id: a.id,
@@ -57,15 +61,27 @@ jobs:
       - name: Unzip website artifact
         run: |
           mkdir public
-          unzip -q 'artifacts/data-[0-1].zip' -d public
-          rm -rf artifacts
-      - name: Setup pull request data
-        id: data
-        run: |
-          PR_NUMBER=$(head -1 public/pull_request/number)
-          PR_NUMBER=${PR_NUMBER//[^0-9]/}
-          echo "PR_NUMBER=${PR_NUMBER}" >> $GITHUB_OUTPUT
-          echo "PR_URL=https://github.com/${GITHUB_REPOSITORY}/pull/${PR_NUMBER}" >> $GITHUB_OUTPUT
+          unzip -q artifacts/data-0.zip -d public
+      - name: Upload prepared website
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: website-preview
+          path: public
+
+  deploy:
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    needs: prepare
+    if: github.event.workflow_run.head_repository.full_name == github.repository
+    steps:
+      - name: Download prepared website
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: website-preview
+          path: public
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -77,15 +93,15 @@ jobs:
           CLOUDFLARE_PROJECT_NAME: ${{ vars.CLOUDFLARE_PROJECT_NAME }}
         run: |
           npm --prefix code ci
-          npm --prefix code exec -- wrangler pages deploy public --project-name "$CLOUDFLARE_PROJECT_NAME" --branch pr-${{ steps.data.outputs.PR_NUMBER }} | tee out.txt
+          npm --prefix code exec -- wrangler pages deploy public --project-name "$CLOUDFLARE_PROJECT_NAME" --branch pr-${{ needs.prepare.outputs.pr_number }} | tee out.txt
           grep 'Deployment complete! Take a peek over at ' out.txt | sed -e 's/.*over at /PREVIEW_URL=/' >> $GITHUB_OUTPUT
       - name: Add comment
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             github.rest.issues.createComment({
-              issue_number: Number(${{ steps.data.outputs.PR_NUMBER }}),
+              issue_number: Number(${{ needs.prepare.outputs.pr_number }}),
               owner: context.repo.owner,
               repo: context.repo.repo,
               body: `🚀 Preview is available at ${{ steps.preview.outputs.PREVIEW_URL }}`