Commit Graph

4 Commits (sql-difference-fn)

Author SHA1 Message Date
Jason Stirnaman 0fbf9e5e9b
fix(ci): complete PR preview path offset and fork PR handling (#6667)
* fix(ci): add path offset for PR preview subdirectory baseURL

When PR preview builds use a subdirectory baseURL like
/docs-v2/pr-preview/pr-XXXX/, shortcodes that parse .RelPermalink
to detect product context fail because the path has extra segments.

This fix:
- Adds config/pr-preview/params.yml with prPreviewPathOffset: 3
- Updates workflow to use -e pr-preview environment
- Updates api-endpoint, influxdb/host, and children shortcodes to
  use the offset when indexing path segments
- Adds nil-safety with default fallback for placeholder_host

Normal builds are unaffected (offset defaults to 0).

* fix(ci): add path offset to product-name and sidebar for PR previews

Apply the same prPreviewPathOffset fix to product-name.html and
sidebar.html that was applied in the initial PR #6665.

These templates parse RelPermalink to detect product context, but when
baseURL includes a subdirectory path (e.g., /docs-v2/pr-preview/pr-XXXX/),
the path indices shift. This fix uses the configurable offset to skip
extra path segments in PR preview builds.

* fix(ci): skip PR preview for fork PRs and add notice comment

Fork PRs cannot deploy to gh-pages because GITHUB_TOKEN has read-only
access to the base repository. This is a GitHub security feature.

Changes:
- Add condition to skip preview job for fork PRs
- Add fork-notice job to post helpful comment explaining limitation
- Include local preview instructions for contributors
2025-12-22 15:30:26 -06:00
Jason Stirnaman 74c33e9483
fix(ci): add path offset for PR preview subdirectory baseURL (#6662)
When PR preview builds use a subdirectory baseURL like
/docs-v2/pr-preview/pr-XXXX/, shortcodes that parse .RelPermalink
to detect product context fail because the path has extra segments.

This fix:
- Adds config/pr-preview/params.yml with prPreviewPathOffset: 3
- Updates workflow to use -e pr-preview environment
- Updates api-endpoint, influxdb/host, and children shortcodes to
  use the offset when indexing path segments
- Adds nil-safety with default fallback for placeholder_host

Normal builds are unaffected (offset defaults to 0).
2025-12-22 10:03:27 -06:00
Jason Stirnaman 61a88db39b
fix(ci): set baseURL for PR preview subdirectory deployment (#6658)
* refactor(ci): improve PR preview with products.yml and index page

- Load product prefixes from data/products.yml (single source of truth)
- Build regex pattern dynamically from loaded namespaces
- Fix CSS copying: Hugo outputs fingerprinted CSS at root level
- Generate index.html with clickable links to preview pages
- Add test for influxdb3_explorer namespace

This keeps the URL parser in sync as new products are added and
provides a better preview experience with navigable links.

* fix(ci): set baseURL for preview subdirectory deployment

Hugo generates absolute paths for fingerprinted assets based on baseURL.
When deploying to GitHub Pages subdirectory (pr-preview/pr-XXXX/), assets
were incorrectly resolving to the root instead of the preview path.

This sets --baseURL to the correct preview URL so all asset paths work.
2025-12-19 18:31:37 -06:00
Jason Stirnaman e203482b62
feat(ci): add PR preview system for GitHub Pages (#6636)
* docs(ci): add PR preview system design

Document the design for GitHub Pages PR previews including:
- Selective deployment of changed pages only
- Reuse of existing content-utils.js change detection
- URL parsing from PR descriptions for layout/asset changes
- Automatic cleanup on PR close
- Storage budget management

* docs(ci): add PR preview implementation plan

Detailed task-by-task implementation plan including:
- 8 tasks with complete code and exact file paths
- Reuses existing content-utils.js for change detection
- Scripts for URL parsing, change detection, file staging
- Main workflow and cleanup workflow
- Setup documentation and testing steps

* feat(ci): add PR URL parser for preview page detection

* fix(ci): harden PR URL parser against malicious input

- Add path validation to reject path traversal attacks (..)
- Add validation to reject HTML/script injection attempts
- Add validation to reject URL-encoded characters
- Update regex to capture markdown link paths: [text](/path/)
- Add comprehensive test suite with 27 security and functionality tests

Security improvements:
- Reject paths containing '..' to prevent directory traversal
- Reject paths with suspicious characters: <, >, |, {, }, `, etc.
- Reject URL-encoded characters to prevent encoding attacks
- Validate all paths against known product prefixes

Functionality improvements:
- Support markdown link syntax: [text](/influxdb3/core/)
- Support reference-style markdown links
- Maintain existing support for production URLs, localhost URLs, and relative paths

* feat(ci): add change detection script for PR previews

* fix(ci): remove unused import from detect-preview-pages.js

* feat(ci): add preview file staging script for selective deployment

* fix(ci): add input validation to preview file staging script

- Add path traversal validation to urlToHtmlPath() to reject paths containing '..'
- Add array validation at start of preparePreviewFiles() with clear error message
- Fix copiedCount to only increment when safeCopy() actually succeeds
- Add return value to copyPage() to track success/failure

Addresses security vulnerabilities and improves accuracy of preview stats.

* feat(ci): add preview comment manager for sticky PR comments

* fix(ci): sanitize user input in preview comments to prevent XSS

* feat(ci): add PR preview workflow for GitHub Pages deployment

* fix(ci): correct environment variables and checkout in PR preview workflow

* feat(ci): add weekly stale preview cleanup workflow

* docs(ci): add PR preview setup guide

* Delete docs/plans/2025-12-16-pr-preview-design.md

* Delete docs/plans/2025-12-16-pr-preview-implementation.md

* fix(ci): add input validation for PR preview security

- Add single quote to rejected characters in URL path validation
  to prevent JavaScript injection in workflow string interpolation
- Add BASE_REF validation regex to prevent command injection,
  allowing slashes for feature branches (e.g., feature/new-auth)
- Add PR_NUM numeric validation in cleanup workflow
- Add tests for single quote handling and BASE_REF validation
2025-12-18 13:44:14 -06:00