From addefd0dc4ae500b39466cf81512bf7ba248f5cd Mon Sep 17 00:00:00 2001
From: Bill Wagner <wiwagn@microsoft.com>
Date: Tue, 27 Oct 2026 17:27:55 -0400
Subject: [PATCH] Split OPS reporting into unprivileged and trusted workflows

- Run artifact collection on `pull_request` with read-only permissions
- Add a trusted `workflow_run` publisher for preview links and diagnostics

Requires the updated producer and publisher actions in dotnet/docs-actions#37
---
 .github/workflows/ops-build-publisher.yml | 45 +++++++++++++++++++++++
 .github/workflows/ops-build-reporter.yml  | 29 +++++++++------
 2 files changed, 63 insertions(+), 11 deletions(-)
 create mode 100644 .github/workflows/ops-build-publisher.yml

diff --git a/.github/workflows/ops-build-publisher.yml b/.github/workflows/ops-build-publisher.yml
new file mode 100644
index 0000000000000..6943407ef16c4
--- /dev/null
+++ b/.github/workflows/ops-build-publisher.yml
@@ -0,0 +1,45 @@
+name: 'Publish OPS build report'
+
+on:
+  workflow_run:
+    workflows: ['OPS build reporter']
+    types: [completed]
+
+permissions:
+  actions: read
+  pull-requests: write
+  checks: write
+
+jobs:
+  publish:
+    name: Publish OPS diagnostics and previews
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      (github.event.workflow_run.conclusion == 'success' ||
+       github.event.workflow_run.conclusion == 'failure')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    concurrency:
+      group: ops-publish-${{ github.repository }}-${{ github.event.workflow_run.head_repository.id }}-${{ github.event.workflow_run.head_branch }}
+      cancel-in-progress: false
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        with:
+          egress-policy: audit
+
+      - name: Download producer report
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ops-build-report
+          path: ${{ runner.temp }}/ops-build-report-download
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - name: Publish validated report
+        uses: dotnet/docs-actions/ops-build-reporter/publish@main
+        with:
+          repo_token: ${{ github.token }}
+          artifact_directory: ${{ runner.temp }}/ops-build-report-download
+          producer_workflow_file: .github/workflows/ops-build-reporter.yml
+          annotate_file_warnings: true
diff --git a/.github/workflows/ops-build-reporter.yml b/.github/workflows/ops-build-reporter.yml
index 93cd85dc854f3..51b83dd2dbe75 100644
--- a/.github/workflows/ops-build-reporter.yml
+++ b/.github/workflows/ops-build-reporter.yml
@@ -1,27 +1,34 @@
 name: 'OPS build reporter'
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened]
 
 permissions:
-  contents: read
+  statuses: read
 
 jobs:
-  ops_build_reporter_job:
-    name: Add preview links and annotate files
+  report:
+    name: Collect OPS diagnostics and previews
     runs-on: ubuntu-latest
-    permissions:
-      statuses: read
-      checks: write
-      pull-requests: write
+    timeout-minutes: 65
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
         with:
           egress-policy: audit
 
-      - uses: dotnet/docs-actions/ops-build-reporter@cdb3719bab6025f7621b04044094048f597b1ae0 # main
+      - name: Produce report artifacts
+        id: report
+        uses: dotnet/docs-actions/ops-build-reporter@main
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          annotate_file_warnings: true
+          repo_token: ${{ github.token }}
+
+      - name: Upload report
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ops-build-report
+          path: ${{ steps.report.outputs.artifact_path }}
+          if-no-files-found: error
+          retention-days: 7
+          overwrite: true