Repository navigation
Upload docs preview #857
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publishes the docs that docs.yml built for a pull request to | |
| # s3://doc-previews/pytorch/tensordict/<PR_NUMBER>, served at | |
| # https://docs-preview.pytorch.org/pytorch/tensordict/<PR_NUMBER>/index.html. | |
| # | |
| # docs.yml cannot do this itself: pull requests from forks get no OIDC token, | |
| # so they cannot obtain AWS credentials. A workflow_run workflow runs in the | |
| # context of this repository's default branch, where OIDC works. | |
| # | |
| # The artifact comes from untrusted pull request code. Its files are only | |
| # uploaded, never executed, and the PR number read from it is used only after | |
| # checking that it is a number and that this PR's head is the commit the docs | |
| # were built from. | |
| name: Upload docs preview | |
| on: | |
| workflow_run: | |
| workflows: | |
| - Generate documentation | |
| types: | |
| - completed | |
| permissions: | |
| actions: read | |
| contents: read | |
| id-token: write | |
| pull-requests: read | |
| jobs: | |
| upload: | |
| if: >- | |
| github.repository == 'pytorch/tensordict' && | |
| github.event.workflow_run.event == 'pull_request' && | |
| github.event.workflow_run.conclusion == 'success' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Download docs artifact | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 | |
| with: | |
| name: docs | |
| path: docs | |
| run-id: ${{ github.event.workflow_run.id }} | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Read and check the PR number | |
| id: metadata | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| HEAD_SHA: ${{ github.event.workflow_run.head_sha }} | |
| run: | | |
| set -euo pipefail | |
| PR_NUMBER="$(grep -m1 '^PR_NUMBER=' docs/pr-metadata.txt | cut -d= -f2- || true)" | |
| if ! [[ "${PR_NUMBER}" =~ ^[0-9]+$ ]]; then | |
| echo "Invalid or missing PR_NUMBER in pr-metadata.txt, aborting." | |
| exit 1 | |
| fi | |
| # A fork controls the artifact, so it could name another PR. Upload | |
| # only if that PR's head is the commit these docs were built from. | |
| # A mismatch also happens when the PR got a new commit while its docs | |
| # were building; the docs run for the new commit uploads instead. | |
| PR_HEAD_SHA="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq .head.sha)" | |
| if [[ "${PR_HEAD_SHA}" != "${HEAD_SHA}" ]]; then | |
| echo "::notice::PR #${PR_NUMBER} head is ${PR_HEAD_SHA}, but the docs were built from ${HEAD_SHA}. Skipping the upload." | |
| exit 0 | |
| fi | |
| echo "pr-number=${PR_NUMBER}" >> "${GITHUB_OUTPUT}" | |
| - name: Configure AWS credentials | |
| if: steps.metadata.outputs.pr-number != '' | |
| uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 | |
| with: | |
| role-to-assume: arn:aws:iam::308535385114:role/arc | |
| aws-region: us-east-1 | |
| - name: Upload docs preview to S3 | |
| if: steps.metadata.outputs.pr-number != '' | |
| env: | |
| PR_NUMBER: ${{ steps.metadata.outputs.pr-number }} | |
| run: | | |
| aws s3 sync docs/ "s3://doc-previews/pytorch/tensordict/${PR_NUMBER}" --exclude pr-metadata.txt --delete --quiet |