diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index d40cd5f..7d74292 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -1,6 +1,19 @@ name: Preview deploy # Runs in the BASE repo's context (pull_request_target), so it has the +<<<<<<< HEAD +# Cloudflare secrets even for fork PRs. That is powerful and risky: a fork PR +# can only be deployed after a write-access maintainer adds the +# `deploy-preview` label, and the label is stripped again on every new push so +# fresh commits must be re-reviewed. Checkout is pinned to the reviewed commit. +# +# Before labeling a fork PR, read the diff — including wrangler.jsonc. A +# malicious `build.command` there would run with the secrets in scope. + +on: + pull_request_target: + types: [labeled, synchronize, reopened] +======= # Cloudflare secrets even for fork PRs. A write-access maintainer opts a PR in # once by adding the `deploy-preview` label. After that, pushes to the PR # auto-redeploy while the label is present — so later commits deploy with the @@ -13,24 +26,60 @@ name: Preview deploy on: pull_request_target: types: [labeled, synchronize] +>>>>>>> upstream/better-master permissions: contents: read pull-requests: write jobs: +<<<<<<< HEAD + # New commits invalidate a prior review: drop the label so a maintainer must + # re-add it after looking at the new code. Closes the label/push race. + strip-label-on-sync: + if: github.event.action == 'synchronize' + runs-on: ubuntu-latest + steps: + - uses: actions/github-script@v7 + with: + script: | + try { + await github.rest.issues.removeLabel({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.payload.pull_request.number, + name: 'deploy-preview', + }); + } catch (e) { + if (e.status !== 404) throw e; // 404 = label wasn't set + } + + # Deploys only at the moment the label is added. `environment: preview` adds + # an optional Approve gate if you configure required reviewers on it. + deploy-preview: + if: github.event.action == 'labeled' && github.event.label.name == 'deploy-preview' + runs-on: ubuntu-latest + environment: preview +======= deploy-preview: if: > (github.event.action == 'labeled' && github.event.label.name == 'deploy-preview') || (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'deploy-preview')) runs-on: ubuntu-latest +>>>>>>> upstream/better-master steps: - uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha }} +<<<<<<< HEAD + # Fork code runs with base secrets — safe only because the label gate + # means a maintainer reviewed this exact sha (incl. wrangler.jsonc) first. + allow-unsafe-pr-checkout: true +======= # Fork code runs with base secrets — the label is the maintainer's opt-in. allow-unsafe-pr-checkout: true +>>>>>>> upstream/better-master - name: Deploy preview to Cloudflare id: deploy uses: cloudflare/wrangler-action@v3 @@ -39,12 +88,27 @@ jobs: accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} wranglerVersion: "4.125.0" command: versions upload +<<<<<<< HEAD +======= +>>>>>>> upstream/better-master - name: Comment preview URL if: always() uses: actions/github-script@v7 with: script: | +<<<<<<< HEAD + const url = '${{ steps.deploy.outputs.deployment-url }}'; + const body = url + ? `Preview deployed: ${url}` + : `Preview deploy ran — see the Action log for the version preview URL.`; + await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.payload.pull_request.number, + body, + }); +======= const marker = ''; const url = '${{ steps.deploy.outputs.deployment-url }}'; const ok = '${{ steps.deploy.outcome }}' === 'success'; @@ -64,3 +128,4 @@ jobs: } else { await github.rest.issues.createComment({ owner, repo, issue_number, body }); } +>>>>>>> upstream/better-master diff --git a/Workshop Page/Workshops.html b/Workshop Page/Workshops.html index a6ebdc0..3e4afb3 100644 --- a/Workshop Page/Workshops.html +++ b/Workshop Page/Workshops.html @@ -339,15 +339,84 @@ + + + + + + + + + + +
diff --git a/Workshop Page/images/BOB_5.0.jpg b/Workshop Page/images/BOB_5.0.jpg new file mode 100644 index 0000000..e548b2c Binary files /dev/null and b/Workshop Page/images/BOB_5.0.jpg differ diff --git a/Workshop Page/images/electro_8.0.jpg b/Workshop Page/images/electro_8.0.jpg new file mode 100644 index 0000000..6ae91b8 Binary files /dev/null and b/Workshop Page/images/electro_8.0.jpg differ