Move the docs-preview workflow scripts out of the YAML into .github/scripts

Merged
MA
2mo ago
+342-92

Pure refactor: no behaviour change to the docs preview flow.

Motivation and Context

docs-preview.yml carried two ~45-line blocks of inline JavaScript in actions/github-script steps (authorize and comment). Inline scripts can't be linted, unit-tested, or reviewed as code, and every edit to them is a YAML diff. require-linked-issue.yml already does this the better way: the logic lives in .github/scripts/pr_intake_gate.js with scenario tests beside it, and the workflow step is a two-line require + call.

This moves the docs-preview logic to .github/scripts/docs_preview.js (authorize and comment exports) in the same shape, verbatim apart from hoisting the marker/bot-login constants. That also sets up the checkout-v7 follow-up (#3445) to be a few lines in the module plus a test, rather than another YAML-embedded edit.

Workflow changes that come with the move:

  • Both authorize and comment now start with a sparse checkout of .github/scripts (persist-credentials: false) so the module is on disk for github-script's require. Under pull_request_target and issue_comment a default checkout resolves to the default branch, so this is trusted code, never the PR's; the header notes it. comment gains contents: read for that checkout.
  • shared.yml's checks job runs node --test '.github/scripts/*.test.js' instead of naming the one gate test file, and the setup-node comment no longer names a github-script major (v9 is still node24).

The Cloudflare cleanup shell block in docs-preview-cleanup.yml stays inline: moving it would mean adding a checkout to a job that holds the Cloudflare token, for little gain.

How Has This Been Tested?

  • New .github/scripts/docs_preview.test.js (14 scenarios) alongside the existing gate tests; node --test '.github/scripts/*.test.js' passes all 43 locally.
  • Ran the pinned actions/github-script v9.0.0 bundle locally against the new two-line authorize stub in a scratch workspace containing only .github/scripts/: the module resolves via the action's wrapped require, authorize runs, and the injected client issues the collaborators-permission request (stopping at the expected 401 with a dummy token).
  • pre-commit run --files on the four touched files.
  • pull_request_target/issue_comment read the workflow from main, so CI on this PR does not exercise the new steps; after merge, /preview-docs on any open docs PR (or the next admin push to one) is the live check.

Breaking Changes

None.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Refactor of CI tooling only.

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

AI Disclaimer