From 13cd4dfd79c583b6402d85970ff21de9e7c83290 Mon Sep 17 00:00:00 2001
From: Simone Bortolin <simonebortolin@users.noreply.github.com>
Date: Thu, 8 Oct 2026 23:23:34 +0200
Subject: [PATCH] Share the site build between the Pages and PR preview
 workflows

Move checkout, install, build and artifact upload into a reusable
build.yml. Pages deploys from a separate job, so the github-pages
artifact is available before deploy-pages looks for it, and the PR
preview builds the untrusted code without access to any secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/build.yml       | 40 +++++++++++++++++++++++++++++++
 .github/workflows/pages.yml       | 31 +++++++-----------------
 .github/workflows/preview-pr.yaml | 31 ++++++++++++------------
 3 files changed, 65 insertions(+), 37 deletions(-)
 create mode 100644 .github/workflows/build.yml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 00000000..4e6d7e6e
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,40 @@
+# Build the VitePress site and upload it as the "github-pages" artifact.
+# Shared by the Pages deploy and the PR preview, which only differ in where
+# the built site is published.
+name: Build site
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: The commit to build (defaults to the triggering one)
+        type: string
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+          fetch-depth: 0 # needed for the last modified date of the pages
+          persist-credentials: false
+      - name: Setup node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - name: Install Node deps
+        run: npm ci
+      - name: Build with VitePress
+        run: npm run build
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: .vitepress/dist
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 6a57b7da..bacf49cb 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -9,11 +9,8 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 # Allow one concurrent deployment
 concurrency:
@@ -21,33 +18,23 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # Build job and deploy
   build:
+    uses: ./.github/workflows/build.yml
+
+  # Runs in its own job so the artifact is fully available before deploying
+  deploy:
+    needs: build
     runs-on: ubuntu-latest
+    # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0 # needed for the last modified date of the pages
-      - name: Setup node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - name: Install Node deps
-        run: npm ci
       - name: Setup Pages
-        id: pages
         uses: actions/configure-pages@v5
-      - name: Build with VitePress
-        run: npm run build
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
-        with:
-          path: .vitepress/dist
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@v4
diff --git a/.github/workflows/preview-pr.yaml b/.github/workflows/preview-pr.yaml
index 0f10ea10..d13c5e50 100644
--- a/.github/workflows/preview-pr.yaml
+++ b/.github/workflows/preview-pr.yaml
@@ -5,7 +5,7 @@ on:
     types: [opened, reopened, synchronize]
 
 permissions:
-  pull-requests: write
+  contents: read
 
 jobs:
   authorize:
@@ -17,32 +17,33 @@ jobs:
     steps:
       - run: "true"
 
+  # The PR code is built without access to any secret
   build:
     needs: authorize
+    uses: ./.github/workflows/build.yml
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}
+
+  deploy:
+    needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-          persist-credentials: false
-      - name: Setup node
-        uses: actions/setup-node@v4
+      - name: Download artifact
+        uses: actions/download-artifact@v4
         with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run build
+          name: github-pages
+      - name: Extract site
+        run: mkdir dist && tar -xf artifact.tar -C dist
       - name: Publish to Cloudflare Pages
         id: preview-pages
         uses: cloudflare/wrangler-action@v3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT }}
-          command: pages deploy .vitepress/dist --project-name=hack-gpon-preview --branch=preview
+          command: pages deploy dist --project-name=hack-gpon-preview --branch=preview
       - uses: thollander/actions-comment-pull-request@v2
         with:
           message: |
             Preview of the website obtained from the PR: ${{ steps.preview-pages.outputs.deployment-url }}
-