deploy-preview.yml

name: Deploy preview environment
on:
  workflow_run:
    workflows: [CI]
    types: [completed]
  workflow_dispatch:
    inputs:
      pr:
        required: true
        type: string
        description: PR number
  pull_request_target:
    types: [labeled]

permissions:
  contents: read
  pull-requests: write
  actions: read
  id-token: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    if: github.repository == 'microsoft/TypeScript-Website'
    environment:
      name: azure-preview
      deployment: false
    env:
      AZURE_STATIC_WEB_APP_NAME: ${{ vars.AZURE_STATIC_WEB_APP_NAME }}
      AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}
    steps:
      - name: Get PR/workflow run info
        id: get-info
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            console.dir(context, { depth: null });

            let pr;
            let workflowRun;
            let isLabel = false;
            switch (context.eventName) {
              case "workflow_dispatch":
                console.log("Workflow dispatch event");
                pr = (await github.rest.pulls.get({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  pull_number: +context.payload.inputs.pr,
                })).data;
                break;
              case "pull_request_target":
                console.log("Pull request target event");
                pr = context.payload.pull_request;
                break;
              case "workflow_run":
                console.log("Workflow run event");
                workflowRun = context.payload.workflow_run;
                pr = workflowRun.pull_requests[0];
                if (pr) {
                  console.log("PR found in workflow run");
                  // Reload the PR to get the labels.
                  pr = (await github.rest.pulls.get({
                    owner: context.repo.owner,
                    repo: context.repo.repo,
                    pull_number: pr.number,
                  })).data;
                } else {
                  const q = `is:pr is:open repo:${context.repo.owner}/${context.repo.repo} sha:${workflowRun.head_sha}`;
                  console.log(`PR not found in workflow run, searching for it with ${q}`);
                  // PRs sent from forks do not get the pull_requests field set.
                  // https://github.com/orgs/community/discussions/25220
                  const response = await github.rest.search.issuesAndPullRequests({ q });
                  if (response.data.items.length > 0) {
                    pr = response.data.items[0];
                  }
                }
            }

            if (!pr) {
              console.log("Could not find PR");
              return null;
            }

            console.log(`Found PR ${pr.html_url}`);
            console.dir(pr, { depth: null });

            if (pr.state !== "open") {
              console.log(`PR ${pr.number} is not open`);
              return null;
            }

            if (!pr.labels.some((label) => label.name === "deploy-preview")) {
              console.log(`PR ${pr.number} does not have the deploy-preview label`);
              return null;
            }

            if (!workflowRun) {
              console.log(`No workflow run found in event, searching for it with ${pr.head.sha}`);
              try {
                workflowRun = (await github.rest.actions.listWorkflowRuns({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  workflow_id: "CI.yml",
                  head_sha: pr.head.sha,
                  per_page: 1,
                })).data.workflow_runs[0];
              } catch (e) {
                console.log(e);
              }
            }

            if (!workflowRun) {
              console.log(`Could not find workflow run for PR ${pr.number}`);
              return null;
            }

            console.log(`Found workflow run ${workflowRun.html_url}`);
            console.dir(workflowRun, { depth: null });

            try {
              const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
                owner: "microsoft",
                repo: "TypeScript-Website",
                run_id: workflowRun.id,
              });
              console.dir(artifacts, { depth: null });
              if (!artifacts.data.artifacts.some(x => x.name === "site")) {
                console.log("No artifact found in workflow run");
                return null;
              }
            } catch (e) {
              console.log(e);
              return null;
            }

            const result = { pr: pr.number, runId: workflowRun.id };
            console.log(result);
            return result;

      - name: Download site build from PR
        if: ${{ steps.get-info.outputs.result != 'null' }}
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: site
          path: site
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ fromJson(steps.get-info.outputs.result).runId }}

      - name: Set up Node.js
        if: ${{ steps.get-info.outputs.result != 'null' }}
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "22.x"

      - name: Log in to Azure
        if: ${{ steps.get-info.outputs.result != 'null' }}
        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

      - name: Deploy
        id: deploy
        if: ${{ steps.get-info.outputs.result != 'null' }}
        env:
          PR_NUMBER: ${{ fromJson(steps.get-info.outputs.result).pr }}
        run: |
          set -euo pipefail
          : "${AZURE_STATIC_WEB_APP_NAME:?Missing AZURE_STATIC_WEB_APP_NAME environment variable}"
          : "${AZURE_RESOURCE_GROUP:?Missing AZURE_RESOURCE_GROUP environment variable}"
          if [[ ! "$PR_NUMBER" =~ ^[1-9][0-9]*$ ]]; then
            echo "::error::Invalid preview PR number"
            exit 1
          fi

          deployment_token="$(az staticwebapp secrets list \
            --name "$AZURE_STATIC_WEB_APP_NAME" \
            --resource-group "$AZURE_RESOURCE_GROUP" \
            --query properties.apiKey --output tsv)"
          if [[ -z "$deployment_token" ]]; then
            echo "::error::Azure returned no preview deployment token"
            exit 1
          fi
          echo "::add-mask::$deployment_token"
          # Keep CLI configuration outside the untrusted artifact.
          printf '{"configurations":{"preview":{}}}\n' > "$RUNNER_TEMP/swa-cli.config.json"
          runtime_config_dir="$(mktemp -d "$RUNNER_TEMP/swa-runtime-config.XXXXXX")"
          if [[ -e "$GITHUB_WORKSPACE/site/staticwebapp.config.json" ]]; then
            cp "$GITHUB_WORKSPACE/site/staticwebapp.config.json" "$runtime_config_dir/"
          else
            echo "No root Static Web Apps config; using an empty runtime configuration"
            printf '{}\n' > "$runtime_config_dir/staticwebapp.config.json"
          fi
          SWA_CLI_DEPLOYMENT_TOKEN="$deployment_token" \
            npx --yes --package=@azure/static-web-apps-cli@2.1.0 swa \
              --config "$RUNNER_TEMP/swa-cli.config.json" deploy \
              --app-location "$GITHUB_WORKSPACE" \
              --output-location "$GITHUB_WORKSPACE/site" \
              --swa-config-location "$runtime_config_dir" \
              --env "$PR_NUMBER"

          hostname="$(az staticwebapp environment show \
            --name "$AZURE_STATIC_WEB_APP_NAME" \
            --resource-group "$AZURE_RESOURCE_GROUP" \
            --environment-name "$PR_NUMBER" \
            --query hostname --output tsv)"
          if [[ ! "$hostname" =~ ^[A-Za-z0-9.-]+\.azurestaticapps\.net$ ]]; then
            echo "::error::Azure returned an invalid hostname for preview $PR_NUMBER"
            exit 1
          fi
          printf 'static_web_app_url=https://%s\n' "$hostname" >> "$GITHUB_OUTPUT"

      - name: Comment on PR
        if: ${{ steps.get-info.outputs.result != 'null' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          PR_NUMBER: ${{ fromJson(steps.get-info.outputs.result).pr }}
          SITE_URL: ${{ steps.deploy.outputs.static_web_app_url }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const prefix = "Azure Static Web Apps: Your preview site is ready!";
            const legacyPrefix = "Azure Static Web Apps: Your stage site is ready!";
            const comments = await github.paginate(github.rest.issues.listComments, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: +process.env.PR_NUMBER,
              per_page: 100,
            });

            for (const comment of comments) {
              if (comment.user?.login === "github-actions[bot]" &&
                  (comment.body?.startsWith(prefix) || comment.body?.startsWith(legacyPrefix))) {
                console.log(`Deleting comment ${comment.id}`);
                await github.rest.issues.deleteComment({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  comment_id: comment.id,
                });
              }
            }

            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: +process.env.PR_NUMBER,
              body: `${prefix} Visit it here: ${process.env.SITE_URL}`
            });