Add PR preview deployment workflow for fork contributions

Enables automatic preview deployments for PRs from forks, streamlining translation review and content editing approval.

Features:
- Builds Jekyll site for fork PRs only (excludes internal PRs)
- Deploys to fork's GitHub Pages under pr-{number}/ directory
- Auto-creates gh-pages branch if needed
- Posts preview URL as PR comment
- Uses fine-grained PAT with minimal permissions (Contents + Pages)

Setup guide included for fork owners.

💖 Generated with Crush

Assisted-by: Claude Sonnet 4.5 via Crush <crush@charm.land>

Author: wildcard

.github/workflows/PR_PREVIEW_SETUP.md

@@ -0,0 +1,73 @@
+# PR Preview Setup Guide
+
+This workflow automatically builds and deploys preview versions of the site for pull requests coming from forks. This is especially useful for translation reviews and content editing.
+
+## How it works
+
+1. When a PR is opened from a fork, the workflow builds the Jekyll site
+2. The built site is deployed to the fork's GitHub Pages under `pr-{number}/`
+3. A comment is posted on the PR with the preview URL
+4. The preview updates automatically when new commits are pushed
+
+## Setup Required (For Fork Owners)
+
+To enable preview deployments from your fork, you need to:
+
+### 1. Create a Fine-Grained Personal Access Token
+- Go to GitHub Settings → Developer settings → Personal access tokens → **Fine-grained tokens**
+- Click "Generate new token"
+- Configure the token:
+  - **Token name:** `PR Preview Deploy`
+  - **Expiration:** Choose your preferred expiration (90 days, 1 year, custom, or no expiration)
+  - **Resource owner:** Select yourself (the fork owner)
+  - **Repository access:** Select "Only select repositories"
+    - Choose your fork repository (e.g., `your-username/training-kit`)
+  - **Permissions → Repository permissions:**
+    - ✅ **Contents:** Read and write (required to push to gh-pages branch)
+    - ✅ **Pages:** Read and write (required to manage GitHub Pages)
+    - ✅ **Metadata:** Read-only (automatically included)
+- Click "Generate token"
+- **Copy the token immediately** (you won't see it again)
+
+### 2. Add the token to your fork's secrets
+- Go to your fork's Settings → Secrets and variables → Actions
+- Click "New repository secret"
+- Name: `PREVIEW_DEPLOY_TOKEN`
+- Value: Paste the fine-grained personal access token you created
+- Click "Add secret"
+
+### 3. Enable GitHub Pages in your fork (after first deployment)
+After the first PR preview is deployed, the gh-pages branch will be created automatically. Then:
+- Go to your fork's Settings → Pages
+- Under "Source", select "Deploy from a branch"
+- Select **gh-pages** branch and **/ (root)** folder
+- Click Save
+- GitHub Pages will be available at: `https://your-username.github.io/training-kit/`
+
+## Preview URL Format
+
+Previews will be available at:
+```
+https://{fork-owner}.github.io/{repo-name}/pr-{number}/
+```
+
+For example:
+```
+https://johndoe.github.io/training-kit/pr-42/
+```
+
+## Security
+
+- Only runs for PRs from forks (not internal PRs)
+- Uses `pull_request_target` to run in the context of the base repository
+- Checks out the specific PR SHA to build exactly what was submitted
+- Uses fine-grained PAT with minimal required permissions (Contents and Pages only)
+- Each fork owner controls their own credentials and deployment
+
+## Notes
+
+- The gh-pages branch is created automatically on first deployment
+- The first deployment may take a few minutes for GitHub Pages to become available
+- Previews persist until manually deleted from the gh-pages branch
+- Each PR gets its own isolated preview directory
+- You can clean up old previews by deleting directories from the gh-pages branch

.github/workflows/pr-preview.yml

@@ -0,0 +1,120 @@
+name: PR Preview Deployment
+
+on:
+  pull_request_target:
+    branches: ["main"]
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  # Only run for PRs from forks
+  check-fork:
+    runs-on: ubuntu-latest
+    outputs:
+      is-fork: ${{ steps.check.outputs.is-fork }}
+    steps:
+      - name: Check if PR is from fork
+        id: check
+        run: |
+          if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
+            echo "is-fork=true" >> $GITHUB_OUTPUT
+          else
+            echo "is-fork=false" >> $GITHUB_OUTPUT
+          fi
+
+  build-and-deploy-preview:
+    needs: check-fork
+    if: needs.check-fork.outputs.is-fork == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout PR branch
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: 16
+          cache: 'npm'
+
+      - name: Install node modules
+        run: npm install
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@ece82769428359c077b5a5eaff268902a303c101
+        with:
+          bundler-cache: true
+
+      - name: Build with Jekyll
+        run: |
+          # Build with baseurl as the fork owner's username for GitHub Pages
+          bundle exec jekyll build --baseurl "/${{ github.event.pull_request.head.repo.name }}"
+        env:
+          JEKYLL_ENV: production
+
+      - name: Deploy to fork's GitHub Pages
+        uses: peaceiris/actions-gh-pages@v3
+        with:
+          # This requires the fork to have a fine-grained PAT as a secret
+          # The fork owner needs to set up PREVIEW_DEPLOY_TOKEN in their repo secrets
+          personal_token: ${{ secrets.PREVIEW_DEPLOY_TOKEN }}
+          publish_dir: ./_site
+          publish_branch: gh-pages
+          destination_dir: pr-${{ github.event.pull_request.number }}
+          user_name: 'github-actions[bot]'
+          user_email: 'github-actions[bot]@users.noreply.github.com'
+          # Create gh-pages branch if it doesn't exist
+          force_orphan: true
+
+      - name: Comment preview URL
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const prNumber = context.payload.pull_request.number;
+            const forkOwner = context.payload.pull_request.head.repo.owner.login;
+            const forkRepo = context.payload.pull_request.head.repo.name;
+            const previewUrl = `https://${forkOwner}.github.io/${forkRepo}/pr-${prNumber}/`;
+            
+            const comment = `## 📝 Preview Deployment
+            
+            Your preview is ready! 🎉
+            
+            🔗 **Preview URL:** ${previewUrl}
+            
+            This preview will be updated automatically when you push new commits to this PR.
+            
+            > **Note:** The preview is deployed to the fork's GitHub Pages. Make sure GitHub Pages is enabled in your fork's settings.`;
+            
+            // Find existing preview comment
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+            });
+            
+            const botComment = comments.find(comment => 
+              comment.user.type === 'Bot' && 
+              comment.body.includes('Preview Deployment')
+            );
+            
+            if (botComment) {
+              // Update existing comment
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: comment
+              });
+            } else {
+              // Create new comment
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                body: comment
+              });
+            }