infra: make workflow data passing secure

Author: AlexanderLanin

.github/workflows/deploy-pages.yml

@@ -35,37 +35,12 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - name: Download build metadata
-        uses: actions/download-artifact@v8.0.1
-        with:
-          name: build-metadata
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ github.token }}
-
-      - name: Parse build metadata
+      - name: Resolve build metadata
         id: metadata
         run: |
-          EVENT_NAME=$(jq -r '.event_name' build-info.json)
-          PR_NUMBER=$(jq -r '.pr_number // empty' build-info.json)
-          REF_NAME=$(jq -r '.ref_name' build-info.json)
-
-          case "$EVENT_NAME" in
-            pull_request|push|merge_group|release) ;;
-            *)
-              echo "::error::Unexpected event_name: $EVENT_NAME"
-              exit 1
-              ;;
-          esac
-
-          if [[ -n "$PR_NUMBER" && ! "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
-            echo "::error::Invalid pr_number: $PR_NUMBER"
-            exit 1
-          fi
-
-          if [[ ! "$REF_NAME" =~ ^[a-zA-Z0-9._/-]+$ ]]; then
-            echo "::error::Invalid ref_name: $REF_NAME"
-            exit 1
-          fi
+          EVENT_NAME="${{ github.event.workflow_run.event }}"
+          PR_NUMBER="${{ github.event.workflow_run.pull_requests[0].number }}"
+          REF_NAME="${{ github.event.workflow_run.head_branch }}"
 
           if [[ "$EVENT_NAME" == "merge_group" ]]; then
             echo "should_deploy=false" >> "$GITHUB_OUTPUT"

.github/workflows/pr.yml

@@ -49,23 +49,3 @@ jobs:
           path: _build
           retention-days: 1
           if-no-files-found: error
-
-      - name: Create build metadata
-        # FIXME: temp for development
-        # "ref_name": "${{ github.ref_name }}",
-        run: |
-          cat > build-info.json <<'EOF'
-          {
-            "event_name": "${{ github.event_name }}",
-            "pr_number": "${{ github.event.pull_request.number }}",
-            "ref_name": "main",
-            "head_sha": "${{ github.sha }}"
-          }
-          EOF
-
-      - name: Upload build metadata
-        uses: actions/upload-artifact@v7.0.1
-        with:
-          name: build-metadata
-          path: build-info.json
-          retention-days: 1