Separate ops workflows

.github/workflows/check-for-build-warnings.yml

@@ -20,6 +20,6 @@ jobs:
       with:
         egress-policy: audit
 
-    - uses: dotnet/docs-actions/status-checker@cdb3719bab6025f7621b04044094048f597b1ae0 # main
+    - uses: dotnet/docs-actions/status-checker@e92e67a4b93ea5976eea3d65af4b2082818c7045 # main
       with:
         repo_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/live-protection.yml

@@ -15,7 +15,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # 3a2844b7e9c422d3c10d287c895573f7108da1b3
         env:
           LIVE_BASE: ${{ github.base_ref == 'live' && github.head_ref != 'main' }}
         with:

.github/workflows/ops-build-publisher.yml

@@ -0,0 +1,45 @@
+name: 'Publish OPS build report'
+
+on:
+  workflow_run:
+    workflows: ['OPS build reporter']
+    types: [completed]
+
+permissions:
+  actions: read
+  pull-requests: write
+  checks: write
+
+jobs:
+  publish:
+    name: Publish OPS diagnostics and previews
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      (github.event.workflow_run.conclusion == 'success' ||
+       github.event.workflow_run.conclusion == 'failure')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    concurrency:
+      group: ops-publish-${{ github.repository }}-${{ github.event.workflow_run.head_repository.id }}-${{ github.event.workflow_run.head_branch }}
+      cancel-in-progress: false
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        with:
+          egress-policy: audit
+
+      - name: Download producer report
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ops-build-report
+          path: ${{ runner.temp }}/ops-build-report-download
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - name: Publish validated report
+        uses: dotnet/docs-actions/ops-build-reporter/publish@e92e67a4b93ea5976eea3d65af4b2082818c7045 # main
+        with:
+          repo_token: ${{ github.token }}
+          artifact_directory: ${{ runner.temp }}/ops-build-report-download
+          producer_workflow_file: .github/workflows/ops-build-reporter.yml
+          annotate_file_warnings: true

.github/workflows/ops-build-reporter.yml

@@ -1,28 +1,35 @@
 name: 'OPS build reporter'
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened]
 
 permissions:
-  contents: read
+  statuses: read
 
 jobs:
-  ops_build_reporter_job:
-    name: Add preview links and annotate files
+  report:
+    name: Collect OPS diagnostics and previews
     runs-on: ubuntu-latest
-    permissions:
-      statuses: read
-      checks: write
-      pull-requests: write
+    timeout-minutes: 65
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
         with:
           egress-policy: audit
 
-      - uses: dotnet/docs-actions/ops-build-reporter@cdb3719bab6025f7621b04044094048f597b1ae0 # main
+      - name: Produce report artifacts
+        id: report
+        uses: dotnet/docs-actions/ops-build-reporter@e92e67a4b93ea5976eea3d65af4b2082818c7045 # main
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          repo_token: ${{ github.token }}
           max_wait_time_minutes: 40
-          annotate_file_warnings: true
+
+      - name: Upload report
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ops-build-report
+          path: ${{ steps.report.outputs.artifact_path }}
+          if-no-files-found: error
+          retention-days: 7
+          overwrite: true

.github/workflows/quest-bulk.yml

@@ -33,23 +33,23 @@ jobs:
 
       - name: Azure OpenID Connect
         id: azure-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main
+        uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
           audience: ${{ secrets.OSMP_API_AUDIENCE }}
 
       - name: Azure DevOps OpenID Connect
         id: azure-devops-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main
+        uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
           audience: ${{ secrets.QUEST_AUDIENCE }}
 
       - name: bulk-sequester
         id: bulk-sequester
-        uses: dotnet/docs-tools/.github/actions/sequester@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main
+        uses: dotnet/docs-tools/.github/actions/sequester@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main
         env:
           ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }}
           ImportOptions__ApiKeys__QuestAccessToken: ${{ steps.azure-devops-oidc-auth.outputs.access-token }}

.github/workflows/quest.yml

@@ -36,15 +36,15 @@ jobs:
 
       - name: Azure OpenID Connect
         id: azure-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main
+        uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
           audience: ${{ secrets.OSMP_API_AUDIENCE }}
 
       - name: Azure DevOps OpenID Connect for manual test runs
         id: azure-devops-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main
+        uses: dotnet/docs-tools/.github/actions/azure-oidc-auth@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
@@ -54,7 +54,7 @@ jobs:
       - name: manual-sequester
         if: ${{ github.event_name == 'workflow_dispatch' }}
         id: manual-sequester
-        uses: dotnet/docs-tools/.github/actions/sequester@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main
+        uses: dotnet/docs-tools/.github/actions/sequester@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main
         env:
           ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }}
           ImportOptions__ApiKeys__AzureAccessToken:  ${{ steps.azure-oidc-auth.outputs.access-token }}
@@ -70,7 +70,7 @@ jobs:
       - name: auto-sequester
         if: ${{ github.event_name != 'workflow_dispatch' }}
         id: auto-sequester
-        uses: dotnet/docs-tools/.github/actions/sequester@a92cd3283e8a81d00b7c5daa6cc604dd2f9abc53 # main
+        uses: dotnet/docs-tools/.github/actions/sequester@579fcf3c388b837a0494ec2f87443ae2e67c5ad3 # main
         env:
           ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }}
           ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }}