Extends slash-commands with a new /stageblog command that lets authorized
maintainers trigger a workflow_dispatch for staging blog previews from fork
PRs, where the normal pull_request-triggered preview cannot access secrets.
- Captures pr.head.sha at comment time and passes it to the dispatched
workflow so fork authors cannot push new commits between review and build
- Disabled unless stageblog-workflow input is set
- Refuses with stageblog-not-blog result if no changed file matches
stageblog-paths (default blog/**)
- Documents companion workflow pattern, additional PAT scope (Actions:
write), and SHA-pinning safety requirement
Move the handler logic out of the YAML script block into a standalone
main.js loaded via require(GITHUB_ACTION_PATH). This improves
readability and makes the JS easier to lint and unit-test directly.
Prow-style PR approval via comment commands, gated by org team membership
or CODEOWNERS of the PR's changed files.
- /lgtm adds 'approved' label + bot APPROVE review; /lgtm cancel undoes both
- /hold adds 'do-not-merge/hold'; /hold cancel or /unhold removes it
- Self-approval is blocked; unauthorized attempts get a thumbs-down reaction only
- New commits pushed to a PR invalidate approval (label removed, review dismissed)
- CODEOWNERS is fetched from the PR base ref to prevent tampering
Requires a PAT or App token with read:org — default GITHUB_TOKEN cannot
check team membership.
Closesmodelcontextprotocol/modelcontextprotocol#2199
The caller already knows how to wire secrets.X into with: inputs; the table
only needs to name the input, not repeat the secret name in a YAML snippet.
- cloudflare-pages-preview/README.md: secrets table now prescribes exact repo
secret names (CF_PAGES_PREVIEW_API_TOKEN, CF_PAGES_PREVIEW_ACCOUNT_ID) with
the literal passed-as YAML snippet. Usage example updated to match.
- CLAUDE.md: mandate the three-column table format with concrete names, and
require usage examples to reference the same names
- cloudflare-pages-preview/README.md: replace secrets table with per-secret
subsections giving exact CF dashboard navigation for obtaining the API token
(My Profile > API Tokens > Custom Token, Account > Pages > Edit permission)
and account ID (right sidebar on any domain/Workers overview), plus explicit
guidance to store each as a named repo secret
- CLAUDE.md: README secrets section must now document the exact UI path to
obtain each secret, minimum permission scope, input mapping, and storage
location
- cloudflare-pages-preview/README.md: add dedicated Required secrets section
listing the CF API token (with minimum permission scope) and account ID,
which inputs they map to, and a note that github-token needs no extra secret
- CLAUDE.md: make Required secrets a mandatory README section for new actions
- README.md: list actions in a table with separate rows for deploy/cleanup
- CLAUDE.md: conventions for adding new composite actions (layout, shell
requirement, env-var input passing, secrets, github-token, README
requirements, validation)
Two composite actions extracted from modelcontextprotocol's blog-preview workflow:
- deploy: injects noindex headers/meta, deploys to CF Pages under a per-PR
branch alias, posts/updates a sticky PR comment with preview URLs
- cleanup: deletes all CF Pages deployments for the PR branch alias on close,
updates the sticky comment
Callers provide a pre-built static HTML directory; the actions handle
everything Cloudflare-specific.
