From a919daa0045bd0bdc2dee0f000573f5fd1669400 Mon Sep 17 00:00:00 2001
From: Donald Labaj <donald.labaj@gmail.com>
Date: Tue, 18 Aug 2026 13:44:02 -0400
Subject: [PATCH] fix(CI): split documentation workflow to avoid
 pull_request_target checkout block

Rebased onto main and merged with the is-release workflow_call changes from
#12598. PR builds use pull_request (artifact upload); deploy uses workflow_run.

Closes #12601

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/documentation-deploy.yml | 55 ++++++++++++++++++++++
 .github/workflows/documentation.yml        | 43 +++++++++++++----
 2 files changed, 89 insertions(+), 9 deletions(-)
 create mode 100644 .github/workflows/documentation-deploy.yml

diff --git a/.github/workflows/documentation-deploy.yml b/.github/workflows/documentation-deploy.yml
new file mode 100644
index 00000000000..9238f485b91
--- /dev/null
+++ b/.github/workflows/documentation-deploy.yml
@@ -0,0 +1,55 @@
+name: Documentation deploy
+on:
+  workflow_run:
+    workflows: [Documentation]
+    types: [completed]
+jobs:
+  deploy:
+    name: Deploy
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion != 'cancelled'
+    env:
+      SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }}
+      SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
+      GH_PR_TOKEN: ${{ secrets.GH_PR_TOKEN }}
+    steps:
+      - name: Check out project
+        uses: actions/checkout@v4
+
+      - name: Set up project
+        uses: ./.github/actions/setup-project
+        with:
+          skip-build: true
+
+      - name: Download PR number
+        uses: actions/download-artifact@v4
+        with:
+          name: pr-number
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set PR number
+        run: echo "GH_PR_NUM=$(cat pr-number.txt)" >> $GITHUB_ENV
+
+      - name: Download documentation
+        uses: actions/download-artifact@v4
+        with:
+          name: documentation
+          path: packages/react-docs/public
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Download a11y coverage
+        uses: actions/download-artifact@v4
+        with:
+          name: a11y-coverage
+          path: packages/react-docs/coverage
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload documentation
+        run: node .github/upload-preview.mjs packages/react-docs/public
+
+      - name: Upload accessibility results
+        if: always()
+        run: node .github/upload-preview.mjs packages/react-docs/coverage
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 22f641c9e11..a6e83398869 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -1,6 +1,6 @@
 name: Documentation
 on:
-  pull_request_target:
+  pull_request:
   issue_comment:
     types: [created]
   workflow_call:
@@ -19,6 +19,7 @@ on:
         required: true
 jobs:
   check-permissions:
+    if: github.event_name == 'issue_comment'
     uses: patternfly/.github/.github/workflows/check-team-membership.yml@fdb52a63a2220ec8a3b6c2d43f312cda708ffa06
     secrets: inherit
 
@@ -29,7 +30,7 @@ jobs:
     if: >-
       always() &&
       !cancelled() &&
-      (inputs.is-release || needs.check-permissions.outputs.allowed == 'true')
+      (inputs.is-release || github.event_name != 'issue_comment' || needs.check-permissions.outputs.allowed == 'true')
     env:
       SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }}
       SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
@@ -37,29 +38,53 @@ jobs:
       GH_PR_NUM: ${{ needs.check-permissions.outputs.pr-number }}
     steps:
       - name: Check out project from PR branch
-        if: github.event_name == 'pull_request_target' || github.event_name == 'issue_comment'
+        if: github.event_name == 'issue_comment'
         uses: actions/checkout@v4
         with:
-          # Checkout the merge commit so that we can access the PR's changes.
-          # This is nessesary because `pull_request_target` checks out the base branch (e.g. `main`) by default.
           ref: refs/pull/${{ env.GH_PR_NUM }}/head
 
       - name: Check out project
-        if: inputs.is-release || github.event_name == 'workflow_call'
+        if: github.event_name != 'issue_comment'
         uses: actions/checkout@v4
+
       - name: Set up and build project
         uses: ./.github/actions/setup-project
 
       - name: Build documentation
         run: yarn build:docs
 
-      - name: Upload documentation
-        if: always()
+      - name: Upload documentation preview
+        if: always() && !cancelled() && github.event_name != 'pull_request'
         run: node .github/upload-preview.mjs packages/react-docs/public
 
       - name: Run accessibility tests
         run: yarn serve:docs & yarn test:a11y
 
       - name: Upload accessibility results
-        if: always()
+        if: always() && !cancelled() && github.event_name != 'pull_request'
         run: node .github/upload-preview.mjs packages/react-docs/coverage
+
+      - name: Upload docs artifact
+        if: always() && !cancelled() && github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v4
+        with:
+          name: documentation
+          path: packages/react-docs/public
+
+      - name: Upload a11y artifact
+        if: always() && !cancelled() && github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v4
+        with:
+          name: a11y-coverage
+          path: packages/react-docs/coverage
+
+      - name: Save PR number
+        if: always() && !cancelled() && github.event_name == 'pull_request'
+        run: echo "${{ github.event.pull_request.number }}" > pr-number.txt
+
+      - name: Upload PR number
+        if: always() && !cancelled() && github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v4
+        with:
+          name: pr-number
+          path: pr-number.txt