create_preview_sites.yml

name: Create Preview Sites

on:
  workflow_call:
    inputs:
      APP_ID:
        description: "App ID for the associated website"
        required: true
        type: string
      APP_NAME:
        description: "Application name for the comment"
        required: true
        type: string
    secrets:
      REQUEST_TOKEN:
        description: "Token for the request"
        required: true
      REQUEST_MESSAGE:
        description: "Message for the request"
        required: true
      ENDPOINT:
        description: "Request endpoint"
        required: true
    outputs:
      pr_number:
        description: "PR number the preview was built for"
        value: ${{ jobs.create_preview_site.outputs.pr_number }}
      sanitized_branch_name:
        description: "Sanitized branch name used for the preview URL"
        value: ${{ jobs.create_preview_site.outputs.sanitized_branch_name }}

permissions:
  contents: read # Restrictive default

jobs:
  create_preview_site:
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read # Required for repository context
      actions: read # Required to download artifacts
      statuses: write # Required to update commit status
    outputs:
      pr_number: ${{ steps.extract.outputs.pr_number }}
      sanitized_branch_name: ${{ steps.extract.outputs.sanitized_branch_name }}
    steps:
      # Get the artifacts with the PR number and branch name
      - name: Download artifact
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const fs = require('fs');
            const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: ${{ github.event.workflow_run.id }},
            });
            const matchArtifact = artifacts.data.artifacts.filter(artifact => artifact.name == "pr")[0];
            const download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            fs.writeFileSync('${{ github.workspace }}/pr.zip', Buffer.from(download.data));

      # Extract the info from the artifact and set variables
      - name: Extract PR info from artifact
        id: extract
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const fs = require('fs');
            const { execSync } = require('child_process');
            const path = require('path');

            execSync('unzip pr.zip -d pr');
            const branchName = fs.readFileSync(path.join('pr', 'branch'), 'utf8').trim();
            const prNumber = fs.readFileSync(path.join('pr', 'number'), 'utf8').trim();
            const integrity = fs.readFileSync(path.join('pr', 'integrity'), 'utf8').trim();

            // Any character outside a-zA-Z0-9 becomes a dash, so any git-legal branch name is
            // safe to use in the Amplify subdomain regardless of its raw content.
            const sanitizedBranchName = branchName.replace(/[^a-zA-Z0-9]/g, '-');
            core.exportVariable('SANITIZED_BRANCH_NAME', sanitizedBranchName);
            core.exportVariable('BRANCH_NAME', branchName);
            core.exportVariable('PR_NUMBER', prNumber);
            core.exportVariable('INTEGRITY', integrity);
            core.setOutput('sanitized_branch_name', sanitizedBranchName);
            core.setOutput('pr_number', prNumber);

      # Validate the integrity of the artifact
      - name: Validate Artifact Integrity
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const crypto = require('crypto');

            const prNumber = process.env.PR_NUMBER;
            const branchName = process.env.BRANCH_NAME;
            const integrity = process.env.INTEGRITY;

            const numberHash = crypto.createHash('sha256').update(prNumber).digest('hex');
            const branchHash = crypto.createHash('sha256').update(branchName).digest('hex');
            const expectedIntegrity = `${numberHash}:${branchHash}`;

            if (expectedIntegrity !== integrity) {
              core.setFailed('Artifact integrity validation failed');
            }

      # Kick off the job in amplify
      - name: Deploy Site
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          APP_ID: ${{ inputs.APP_ID }}
          APP_NAME: ${{ inputs.APP_NAME }}
          REQUEST_TOKEN: ${{ secrets.REQUEST_TOKEN }}
          REQUEST_MESSAGE: ${{ secrets.REQUEST_MESSAGE }}
          ENDPOINT: ${{ secrets.ENDPOINT }}
        with:
          script: |
            const crypto = require('crypto');
            const https = require('https');

            // Access secrets through environment variables
            const appId = process.env.APP_ID;
            const appName = process.env.APP_NAME;
            const requestToken = process.env.REQUEST_TOKEN;
            const requestMessage = process.env.REQUEST_MESSAGE;
            const endpoint = process.env.ENDPOINT;
            const sanitizedBranchName = process.env.SANITIZED_BRANCH_NAME;

            const hmacKey = crypto.createHmac('sha256', requestToken).update(requestMessage).digest('hex');
            const signature = `sha256=${hmacKey}`;

            const makeRequest = () => {
              return new Promise((resolve, reject) => {
                const options = {
                  method: 'POST',
                  headers: {
                    'Content-Type': 'application/json',
                    'X-Hub-Signature': signature,
                  }
                };

                const req = https.request(endpoint, options, (res) => {
                  let data = '';
                  res.on('data', (chunk) => { data += chunk; });
                  res.on('end', () => {
                    resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, status: res.statusCode });
                  });
                });

                req.on('error', (error) => {
                  reject(error);
                });

                req.write(JSON.stringify({
                  app_id: appId,
                  branch_name: sanitizedBranchName,
                }));

                req.end();
              });
            };

            const response = await makeRequest();

            if (!response.ok) {
              core.setFailed(`Request failed with response code ${response.status}`);
            }