From 7af6a15f80b38aec5e4e6f637fe778c81f8bfc78 Mon Sep 17 00:00:00 2001
From: Amanuel Sisay <amanabiy@amazon.de>
Date: Mon, 29 Jun 2026 21:06:29 +0200
Subject: [PATCH 1/2] feat: deploy dev pages preview for fork pull requests

---
 .github/actions/deploy-static/action.yml  |  6 +++-
 .github/workflows/deploy-fork-preview.yml | 44 +++++++++++++++++++++++
 .github/workflows/deploy.yml              |  4 ++-
 3 files changed, 52 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/deploy-fork-preview.yml

diff --git a/.github/actions/deploy-static/action.yml b/.github/actions/deploy-static/action.yml
index 1a0513d..64ca896 100644
--- a/.github/actions/deploy-static/action.yml
+++ b/.github/actions/deploy-static/action.yml
@@ -14,6 +14,10 @@ inputs:
   target-path:
     description: Path prefix on the deployment URL
     required: true
+  commit-sha:
+    description: Commit SHA used in the deployment path
+    required: false
+    default: ${{ github.event.pull_request.head.sha }}
 
 outputs:
   preview-url:
@@ -32,7 +36,7 @@ runs:
       id: deployment-path
       shell: bash
       run: |
-        echo "deployment-path=${{ github.event.repository.name }}/${{ github.event.pull_request.head.sha }}/${{ inputs.target-path }}/" >> $GITHUB_OUTPUT
+        echo "deployment-path=${{ github.event.repository.name }}/${{ inputs.commit-sha }}/${{ inputs.target-path }}/" >> $GITHUB_OUTPUT
     - name: Deploy content
       id: deploy
       shell: bash
diff --git a/.github/workflows/deploy-fork-preview.yml b/.github/workflows/deploy-fork-preview.yml
new file mode 100644
index 0000000..3eaf740
--- /dev/null
+++ b/.github/workflows/deploy-fork-preview.yml
@@ -0,0 +1,44 @@
+name: Deploy fork preview
+
+on:
+  workflow_call:
+    inputs:
+      artifact-name:
+        description: Artifact to download/deploy; also the target path and the `fork-` environment suffix
+        type: string
+        required: true
+
+permissions:
+  id-token: write
+  contents: read
+  deployments: write
+  actions: read
+
+jobs:
+  deploy:
+    if: >
+      ${{ github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name }}
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    environment:
+      name: fork-${{ inputs.artifact-name }}
+      url: ${{ steps.deploy.outputs.preview-url }}index.html
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ inputs.artifact-name }}
+          path: build
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+      - name: Deploy dev-pages
+        id: deploy
+        uses: cloudscape-design/actions/.github/actions/deploy-static@main
+        with:
+          role-to-assume: ${{ secrets.AWS_PREVIEW_ROLE_ARN }}
+          deployment-bucket: ${{ secrets.AWS_PREVIEW_BUCKET_NAME }}
+          source-path: build
+          target-path: ${{ inputs.artifact-name }}
+          commit-sha: ${{ github.event.workflow_run.head_sha }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f970d7b..5664731 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -19,7 +19,9 @@ permissions:
 
 jobs:
   deploy:
-    if: github.event_name == 'pull_request'
+    if: >
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     continue-on-error: true
     environment:

From 5c2237fa1edb75292c8c145e3865bb53e824935f Mon Sep 17 00:00:00 2001
From: Amanuel Sisay <amanabiy@amazon.de>
Date: Wed, 1 Jul 2026 15:23:37 +0200
Subject: [PATCH 2/2] fix: avoid following symlink

Pass --no-follow-symlinks to  so the deploy step never dereferences symlinks in the source directory.

The deploy runs with the AWS preview credentials, and for fork PR previews. Without this flag,  follows symlinks by default, so a symlink planted in the artifact could cause the runner's temporary AWS credentials to be copied into the public, CloudFront-fronted preview bucket.
---
 .github/actions/deploy-static/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/deploy-static/action.yml b/.github/actions/deploy-static/action.yml
index 64ca896..c0dbad8 100644
--- a/.github/actions/deploy-static/action.yml
+++ b/.github/actions/deploy-static/action.yml
@@ -41,4 +41,4 @@ runs:
       id: deploy
       shell: bash
       run: |
-        aws s3 cp ${{ inputs.source-path }} s3://${{ inputs.deployment-bucket }}/${{ steps.deployment-path.outputs.deployment-path }} --recursive
+        aws s3 cp ${{ inputs.source-path }} s3://${{ inputs.deployment-bucket }}/${{ steps.deployment-path.outputs.deployment-path }} --recursive --no-follow-symlinks