Add PR report preview workflow with Netlify deployment#3494
Open
ewels wants to merge 7 commits into
Open
Conversation
Adds a GitHub Actions workflow that: - Detects which MultiQC modules were modified in a PR - Runs MultiQC with only those modules against test data - Deploys the HTML report to Netlify as a draft deploy - Posts a sticky comment on the PR with the report link https://claude.ai/code/session_01JjK4tKCRqVqd5qrYv19SLb
The single-workflow approach couldn't work for fork PRs because `pull_request` events from forks don't have access to repo secrets. Split into: - pr_report_preview.yml (build): runs on `pull_request`, builds the report, saves PR metadata, uploads everything as an artifact. No secrets needed, safe for forks. - pr_report_deploy.yml (deploy): runs on `workflow_run` when the build completes, downloads the artifact, deploys to Netlify, and posts the PR comment. Runs in the base repo context with secret access. https://claude.ai/code/session_01JjK4tKCRqVqd5qrYv19SLb
- Remove automatic code review on PR open — /review comment is now
the only way to trigger it
- Add /preview command to trigger report preview builds
- Consolidate into 3 workflows (from 4):
1. Trigger: fires on /review or /preview PR comments, saves PR
metadata and which command(s) were requested
2. Review: workflow_run consumer, gates on /review command
3. Preview: workflow_run consumer, gates on /preview command,
builds report + deploys to Netlify in one job
- Delete separate pr_report_deploy.yml (merged into preview workflow)
- Both /review and /preview work on fork PRs since workflow_run
always executes in the base repo context with access to secrets
https://claude.ai/code/session_01JjK4tKCRqVqd5qrYv19SLb
Add instructions for the PR automation commands to: - PR template: small <sup> note at the bottom prompting contributors to use the commands when ready - .github/CONTRIBUTING.md: new "PR automation commands" section under the review workflow - docs/markdown/development/contributing.md: new section at the top of the contributing guide https://claude.ai/code/session_01JjK4tKCRqVqd5qrYv19SLb
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+111
to
+115
| - name: "Install MultiQC" | ||
| if: steps.detect.outputs.has_modules == 'true' | ||
| run: pip install . | ||
|
|
||
| - name: "Download test data" |
Check failure
Code scanning / CodeQL
Checkout of untrusted code in a privileged context Critical
|
|
||
| - name: "Install MultiQC" | ||
| if: steps.detect.outputs.has_modules == 'true' | ||
| run: pip install . |
Check failure
Code scanning / CodeQL
Artifact poisoning Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
In general, to fix artifact poisoning you should never let downloaded artifacts overwrite files that will later be executed or installed. Instead, extract artifacts into a dedicated temporary directory, and only read specific files from there after validating their contents. Keep the repository tree (from actions/checkout) separate from artifact contents, especially when running commands like pip install . that execute code from the local filesystem.
For this workflow, the best fix with minimal behavioral change is:
- Explicitly create a temporary subdirectory under
${{ runner.temp }}(e.g.,${{ runner.temp }}/pr-info) before downloading the artifact. - Configure
actions/download-artifact@v4to extract thepr-infoartifact into that temp directory via itspathinput, so it cannot overwrite any files in the repository working directory. - Update the “Check if preview was requested” step to read
run-preview,pr-number.txt, andhead-sha.txtfrom the temp directory instead of the workspace root. - Ensure that all downstream uses of
PR_NUMBERandHEAD_SHAcontinue to rely on the validated values via step outputs, which is already the case; no change needed there. - Leave
pip install .unchanged, as it will then install from a repository that cannot have been modified by the downloaded artifact.
Concretely, in .github/workflows/pr_report_preview.yml you’ll add a step to create ${{ runner.temp }}/pr-info and modify the existing “Download PR info” and “Check if preview was requested” steps to use that directory.
Suggested changeset
1
.github/workflows/pr_report_preview.yml
| @@ -19,24 +19,30 @@ | ||
| pull-requests: write | ||
|
|
||
| steps: | ||
| - name: Prepare temp directory for PR info | ||
| run: mkdir -p "${{ runner.temp }}/pr-info" | ||
|
|
||
| - name: Download PR info | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: pr-info | ||
| github-token: ${{ github.token }} | ||
| run-id: ${{ github.event.workflow_run.id }} | ||
| path: ${{ runner.temp }}/pr-info | ||
|
|
||
| - name: Check if preview was requested | ||
| id: pr-info | ||
| run: | | ||
| if [ ! -f run-preview ]; then | ||
| ARTIFACT_DIR="${{ runner.temp }}/pr-info" | ||
|
|
||
| if [ ! -f "$ARTIFACT_DIR/run-preview" ]; then | ||
| echo "Not a /preview request, skipping" | ||
| echo "skip=true" >> "$GITHUB_OUTPUT" | ||
| exit 0 | ||
| fi | ||
|
|
||
| PR_NUMBER=$(cat pr-number.txt) | ||
| HEAD_SHA=$(cat head-sha.txt) | ||
| PR_NUMBER=$(cat "$ARTIFACT_DIR/pr-number.txt") | ||
| HEAD_SHA=$(cat "$ARTIFACT_DIR/head-sha.txt") | ||
|
|
||
| # Validate PR number is a positive integer | ||
| if ! echo "$PR_NUMBER" | grep -qE '^[0-9]+$'; then |
Copilot is powered by AI and may make mistakes. Always verify output.
Address GitHub Advanced Security findings: - Move all step output expressions out of run: blocks into env: variables to prevent GitHub Actions template injection - Add validation that PR number is a positive integer - Add validation that HEAD SHA is a 40-char hex string - Add validation that module names contain only safe characters (alphanumeric, hyphens, underscores) The "checkout of untrusted code" and "artifact poisoning" findings are inherent to the feature (we must install the PR's code to build the report) and cannot be mitigated without removing the feature. https://claude.ai/code/session_01JjK4tKCRqVqd5qrYv19SLb
The build workflow (pr_report_preview.yml) checks out and runs untrusted PR code but has NO access to deployment secrets — only a read-only GITHUB_TOKEN. The deploy workflow (pr_report_deploy.yml) has access to Netlify secrets but NEVER checks out or executes untrusted code — it only deploys pre-built HTML from an artifact. This 3-step chain (trigger → build → deploy) ensures: - Untrusted code never runs alongside deployment credentials - Deployment secrets are never exposed to PR authors - The HTML artifact is the only thing that crosses the boundary https://claude.ai/code/session_01JjK4tKCRqVqd5qrYv19SLb
This reverts commit 9ddd2cf.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a GitHub Actions workflow that:
https://claude.ai/code/session_01JjK4tKCRqVqd5qrYv19SLb