diff --git a/.github/workflows/build-sphinx.yml b/.github/workflows/build-sphinx.yml index 9d67c9c66c9..86ba9c9ad23 100644 --- a/.github/workflows/build-sphinx.yml +++ b/.github/workflows/build-sphinx.yml @@ -11,8 +11,6 @@ permissions: read-all env: GH_BOT_NAME: 'github-actions[bot]' GH_BOT_EMAIL: 'github-actions[bot]@users.noreply.github.com' - GH_EVENT_OPEN_PR_UPSTREAM: ${{ github.event_name == 'pull_request' && github.event.action != 'closed' && - github.event.pull_request && !github.event.pull_request.base.repo.fork }} GH_EVENT_PUSH_UPSTREAM: ${{ github.ref == 'refs/heads/master' && github.event_name == 'push' && github.event.ref == 'refs/heads/master' && github.event.repository && !github.event.repository.fork }} PUBLISH_DIR: doc/_build/html/ @@ -191,6 +189,26 @@ jobs: - name: Copy backend docs run: cp -r dpnp/backend/doc/html ${{ env.PUBLISH_DIR }}/backend_doc + # Detect if this is a fork PR + - name: Check if fork PR + id: check_fork + run: | + IS_FORK="false" + if [ "${{ github.event_name }}" == "pull_request" ] && [ "${{ github.event.pull_request.head.repo.fork }}" == "true" ]; then + IS_FORK="true" + fi + echo "is_fork=$IS_FORK" >> "$GITHUB_OUTPUT" + echo "Is fork PR: $IS_FORK" + + # Upload artifact for fork PRs + - name: Upload docs artifact (Fork PRs) + if: steps.check_fork.outputs.is_fork == 'true' && github.event.action != 'closed' + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 + with: + name: pr-${{ github.event.number }}-docs + path: ${{ env.PUBLISH_DIR }} + retention-days: 30 + # The step is only used to build docs while pushing a PR to "master" - name: Deploy docs if: env.GH_EVENT_PUSH_UPSTREAM == 'true' @@ -206,7 +224,7 @@ jobs: # The step is only used to build docs while pushing to PR branch - name: Publish pull-request docs - if: env.GH_EVENT_OPEN_PR_UPSTREAM == 'true' + if: github.event_name == 'pull_request' && github.event.action != 'closed' && steps.check_fork.outputs.is_fork == 'false' uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} @@ -219,23 +237,64 @@ jobs: user_name: ${{ env.GH_BOT_NAME }} user_email: ${{ env.GH_BOT_EMAIL }} - # The step is only used to build docs while pushing to PR branch - - name: Comment with URL to published pull-request docs - if: env.GH_EVENT_OPEN_PR_UPSTREAM == 'true' + # Prepare documentation preview comment based on PR type + - name: Prepare docs preview comment + if: github.event_name == 'pull_request' && github.event.action != 'closed' + id: docs_comment env: PR_NUM: ${{ github.event.number }} + IS_FORK: ${{ steps.check_fork.outputs.is_fork }} + run: | + if [ "$IS_FORK" == "true" ]; then + # Fork PR - provide artifact download instructions + cat << 'EOF' >> "$GITHUB_OUTPUT" + message< + Why can't fork PRs publish automatically? + + Fork PRs run with restricted permissions to prevent malicious code from modifying the repository or accessing secrets. This is a GitHub security feature to protect open source projects. + + COMMENT_EOF + EOF + else + # Upstream PR - provide direct URL + cat << 'EOF' >> "$GITHUB_OUTPUT" + message<