From 960b741372b00d95f115647db5ce60b9cf50f5a1 Mon Sep 17 00:00:00 2001
From: zqlu <zqlu.cn@gmail.com>
Date: Thu, 3 Dec 2020 23:02:16 +0800
Subject: [PATCH] chore: fix preview workflow vulnerability (#2069)

---
 .github/workflows/preview-build.yml  | 26 ++++++++++++++++++++++++++
 .github/workflows/preview-upload.yml | 28 ++++++++++++++++++++++++++++
 .github/workflows/preview.yml        | 19 -------------------
 3 files changed, 54 insertions(+), 19 deletions(-)
 create mode 100644 .github/workflows/preview-build.yml
 create mode 100644 .github/workflows/preview-upload.yml
 delete mode 100644 .github/workflows/preview.yml

diff --git a/.github/workflows/preview-build.yml b/.github/workflows/preview-build.yml
new file mode 100644
index 0000000000..670b7d3430
--- /dev/null
+++ b/.github/workflows/preview-build.yml
@@ -0,0 +1,26 @@
+name: Surge PR Preview - Build Stage
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  build-preview:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: checkout PR
+        uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: build dist
+        run: |
+          npm install
+          npm run site:build
+
+      - name: upload dist artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: pr-build-dist
+          path: public/
diff --git a/.github/workflows/preview-upload.yml b/.github/workflows/preview-upload.yml
new file mode 100644
index 0000000000..97485b9504
--- /dev/null
+++ b/.github/workflows/preview-upload.yml
@@ -0,0 +1,28 @@
+name: Surge PR Preview - Upload Stage
+
+on:
+  workflow_run:
+    workflows: ["Surge PR Preview - Build Stage"]
+    types:
+      - completed
+
+jobs:
+  upload-preview:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' }}
+
+    steps:
+      - name: download dist artifact
+        uses: dawidd6/action-download-artifact@v2
+        with:
+          workflow: ${{ github.event.workflow_run.workflow_id }}
+          name: pr-build-dist
+          path: public/
+
+      - name: deploy to Surge
+        uses: afc163/surge-preview@v1
+        with:
+          surge_token: ${{ secrets.SURGE_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          build: echo done
+          dist: public
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
deleted file mode 100644
index 50f782f4f0..0000000000
--- a/.github/workflows/preview.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-name: 🔂 Surge PR Preview
-
-on: pull_request_target
-
-jobs:
-  preview:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: afc163/surge-preview@v1
-        with:
-          surge_token: ${{ secrets.SURGE_TOKEN }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          build: |
-            yarn
-            yarn site:build
-          dist: public