dajiaohuang opened a new pull request, #7386: URL: https://github.com/apache/datafusion-comet/pull/7386
## Which issue does this PR close? Closes #7320. ## Rationale for this change The docs build installs and runs dependencies in the same job that can push to the repository. A separate writer keeps the repository write token out of the dependency build. This does not make the generated site trustworthy: a compromised builder can still change the output that is published. ## What changes are included in this PR? - Narrow the build job to `contents: read` and disable checkout credential persistence. Keep the existing source and rendered Mermaid checks before publishing. - Upload the built site and its `.asf.yaml` and `.nojekyll` as an artifact. A fresh job with `contents: write` checks out `asf-site`, downloads the artifact, and runs only the existing static copy and publication path. The caller's write permission and its main-branch guard remain unchanged. - Preserve `.git` during the `rsync --delete`, explicitly copy `.asf.yaml` after rsync, and touch `.nojekyll`, as the old publication step did. Explicitly copying the metadata matters even when old and new files have the same size and mtime. - Add CI configuration checks for the permission split and a disposable site-copy regression test to preflight. The slim preflight image installs rsync for that test. ## How are these changes tested? - `python3 dev/ci/check-ci-config.py` passed. A separate local mutation check rejected changes to the build permission, persisted credentials, build dependency, hidden-file setting, and deploy download action. - `python3 dev/ci/test-docs-site-copy.py` passed against synthetic files: `.git` was retained, stale output removed, and `.asf.yaml`, `.nojekyll`, and the new page were present. Before restoring the explicit metadata copy, the same-size/same-mtime fixture showed that rsync could retain the old `.asf.yaml`. - `actionlint -shellcheck=off` and `git diff --check` passed. - No workflow was dispatched and no site or production service was modified. The actual GitHub artifact transfer and deploy have not been run end to end. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
