codex-preview.yml

name: Codex Preview

on:
  workflow_call:
    inputs:
      codex-env:
        description: The environment to build the codex for
        required: false
        default: "internal"
        type: string
      docs-builder-version:
        description: Version of docs-builder to use (e.g. edge, 1.2.3)
        required: false
        default: "edge"
        type: string
      path-pattern:
        description: The path pattern to check for changes
        required: false
        default: '**'
        type: string
      path-pattern-ignore:
        description: The path pattern to ignore changes
        required: false
        default: ''
        type: string

concurrency:
  group: ${{github.workflow}}-${{ github.ref }}

permissions:
  id-token: write
  deployments: write
  contents: read
  pull-requests: write

jobs:
  check:
    permissions:
      pull-requests: read
      contents: read
    runs-on: ubuntu-slim
    outputs:
      any_modified: ${{ steps.check-files.outputs.any_modified }}
    steps:
      - name: Checkout
        # Checkout is needed to get changed files when the event is not a pull request
        if: contains(fromJSON('["push", "merge_group", "workflow_dispatch"]'), github.event_name)
        uses: actions/checkout@v6
      - name: Check changes
        id: check-files
        uses: tj-actions/changed-files@v47.0.6
        with:
          files: ${{ inputs.path-pattern }}
          files_ignore: |
            ${{ inputs.path-pattern-ignore }}
            .github/**
            README.md
  build:
    needs: check
    outputs:
      path_prefix: ${{ steps.codex-build.outputs.path-prefix }}
    permissions:
      contents: read
      id-token: write
    runs-on: ${{ needs.check.outputs.any_modified == 'true' && 'ubuntu-latest' || 'ubuntu-slim' }}
    steps:
      - name: Checkout code
        if: needs.check.outputs.any_modified == 'true'
        # We would need to checkout the PR branch if the event to support pull_request_target.
        # Skip this for now because it's not clear if we need to or should support it.
        # However, the rest of the workflow is designed to support pull_request_target.
        uses: actions/checkout@v6
      - uses: elastic/docs-actions/codex/build@v1
        if: needs.check.outputs.any_modified == 'true'
        id: codex-build
        with:
          docs-builder-version: ${{ inputs.docs-builder-version }}
      - name: Warn about fork PR
        if: >
          startsWith(github.event_name, 'pull_request')
          && github.event.pull_request.head.repo.full_name != github.repository
          && needs.check.outputs.any_modified == 'true'
        run: |
          echo "::warning::Preview deployments are only available for PRs from the same repository, not from forks." \
            "You can either change the event to pull_request_target or push the branch to the upstream repository instead."
      - name: Skip build
        if: needs.check.outputs.any_modified == 'false'
        run: |
          echo "::warning::No changes detected, skipping build."

  deploy:
    if: >
      needs.check.outputs.any_modified == 'true'
      && contains(fromJSON('["pull_request", "pull_request_target"]'), github.event_name)
      && (github.event_name == 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository)
    permissions:
      id-token: write
      deployments: write
    needs:
      - check
      - build
    runs-on: ubuntu-latest
    steps:
      - name: Create Deployment
        if: contains(fromJSON('["pull_request", "pull_request_target", "workflow_dispatch"]'), github.event_name)
        uses: actions/github-script@v9
        id: deployment
        with:
          result-encoding: string
          script: |
            const { owner, repo } = context.repo;
            const prNumber = process.env.PR_NUMBER;
            const environment = 'codex-preview';
            const task = prNumber ? `codex-preview-${prNumber}` : undefined;
            const deployment = await github.rest.repos.createDeployment({
                owner,
                repo,
                environment,
                task,
                ref: process.env.REF,
                auto_merge: false,
                transient_environment: true,
                required_contexts: [],
            })
            await github.rest.repos.createDeploymentStatus({
                deployment_id: deployment.data.id,
                owner,
                repo,
                state: "in_progress",
                log_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
            })
            return deployment.data.id
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REF: ${{ startsWith(github.event_name, 'pull_request') && github.event.pull_request.head.sha || github.ref_name }}
      - name: Download artifact
        uses: actions/download-artifact@v8
        with:
          name: docs
          path: docs
      - name: Reject symlinks in build output
        run: |
          if find docs -type l | grep -q .; then
            echo "::error::Symlinks found in build output — refusing to deploy"
            find docs -type l -ls
            exit 1
          fi
      - uses: elastic/docs-actions/aws/auth@v1
        with:
          aws_role_name_prefix: codex-eng-preview-
      - name: AWS sync docs to S3
        id: s3-upload
        run: |
          aws s3 sync docs "s3://elastic-codex-website-internal${PATH_PREFIX}" --delete --no-follow-symlinks
          aws cloudfront create-invalidation \
            --distribution-id E1BSBYLPE05D2R \
            --paths "${PATH_PREFIX}" "${PATH_PREFIX}/*"
        env:
          PATH_PREFIX: ${{ needs.build.outputs.path_prefix }}
          AWS_RETRY_MODE: standard
          AWS_MAX_ATTEMPTS: 3
      - name: Update deployment status
        uses: actions/github-script@v9
        if: always() && steps.deployment.outputs.result
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PATH_PREFIX: ${{ needs.build.outputs.path_prefix }}
        with:
          script: |
            await github.rest.repos.createDeploymentStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              deployment_id: ${{ steps.deployment.outputs.result }},
              state: "${{ steps.s3-upload.outcome == 'success' && 'success' || 'failure' }}",
              environment_url: `https://codex.elastic.dev${process.env.PATH_PREFIX}`,
              log_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
            })

  update-link-index:
    needs:
      - build
      - check
    permissions:
      id-token: write
    if: >
      needs.check.outputs.any_modified == 'true'
      && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
      && contains(fromJSON('["push", "workflow_dispatch"]'), github.event_name)
      && github.event.repository.fork == false
    runs-on: ubuntu-slim
    steps:
      - uses: elastic/docs-actions/codex/update-link-index@v1
        with:
          codex-env: ${{ inputs.codex-env }}