workflow corrections (#11)

* workflow corrections

* Updated job permissions

.github/actions/deploy/vercel/development/action.yml

@@ -1,6 +1,11 @@
 name: 'Deploy to Vercel Preview'
 description: 'Deploys the application to Vercel preview environment'
 
+outputs:
+  deployment-url:
+    description: 'The URL of the preview deployment'
+    value: ${{ steps.deploy.outputs.deployment-url }}
+
 inputs:
   vercel-token:
     description: 'Vercel authentication token'
@@ -41,17 +46,6 @@ runs:
       env:
         VERCEL_ORG_ID: ${{ inputs.vercel-org-id }}
         VERCEL_PROJECT_ID: ${{ inputs.vercel-project-id }}
+      id: deploy
       run: |
-        DEPLOYMENT_URL=$(vercel deploy --prebuilt --token=${{ inputs.vercel-token }})
-        echo "DEPLOYMENT_URL=$DEPLOYMENT_URL" >> $GITHUB_ENV
-          
-    - name: Add preview URL to pull request
-      uses: actions/github-script@v6
-      with:
-        script: |
-          github.rest.issues.createComment({
-            issue_number: ${{ inputs.pr-number }},
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: `✨ Preview deployment is ready at: ${process.env.DEPLOYMENT_URL}`
-          })
+        echo "deployment-url=$(vercel deploy --prebuilt --token=${{ inputs.vercel-token }})" >> $GITHUB_OUTPUT

.github/actions/deploy/vercel/production/action.yml

@@ -1,6 +1,11 @@
 name: 'Deploy to Vercel Production'
 description: 'Deploys the application to Vercel production environment'
 
+outputs:
+  deployment-url:
+    description: 'The URL of the Vercel deployment'
+    value: ${{ steps.deploy.outputs.deployment-url }}
+
 inputs:
   vercel-token:
     description: 'Vercel authentication token'
@@ -41,29 +46,6 @@ runs:
       env:
         VERCEL_ORG_ID: ${{ inputs.vercel-org-id }}
         VERCEL_PROJECT_ID: ${{ inputs.vercel-project-id }}
+      id: deploy
       run: |
-        DEPLOYMENT_URL=$(vercel deploy --prebuilt --prod --token=${{ inputs.vercel-token }})
-        echo "DEPLOYMENT_URL=$DEPLOYMENT_URL" >> $GITHUB_ENV
-          
-    - name: Update GitHub deployment status
-      uses: actions/github-script@v6
-      with:
-        script: |
-          const deployment = await github.rest.repos.createDeployment({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            ref: '${{ inputs.sha }}',
-            environment: 'Production',
-            auto_merge: false,
-            required_contexts: [],
-            description: 'Production deployment via Vercel'
-          });
-          
-          await github.rest.repos.createDeploymentStatus({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            deployment_id: deployment.data.id,
-            state: 'success',
-            environment_url: process.env.DEPLOYMENT_URL,
-            description: '✨ Production deployment completed'
-          });
+        echo "deployment-url=$(vercel deploy --prebuilt --prod --token=${{ inputs.vercel-token }})" >> $GITHUB_OUTPUT

.github/actions/deploy/vercel/staging/action.yml

@@ -1,6 +1,11 @@
 name: 'Deploy to Vercel Staging'
 description: 'Deploys the application to Vercel staging environment'
 
+outputs:
+  deployment-url:
+    description: 'The URL of the Vercel deployment'
+    value: ${{ steps.deploy.outputs.deployment-url }}
+
 inputs:
   vercel-token:
     description: 'Vercel authentication token'
@@ -41,29 +46,6 @@ runs:
       env:
         VERCEL_ORG_ID: ${{ inputs.vercel-org-id }}
         VERCEL_PROJECT_ID: ${{ inputs.vercel-project-id }}
+      id: deploy
       run: |
-        DEPLOYMENT_URL=$(vercel deploy --prebuilt --token=${{ inputs.vercel-token }})
-        echo "DEPLOYMENT_URL=$DEPLOYMENT_URL" >> $GITHUB_ENV
-          
-    - name: Update GitHub deployment status
-      uses: actions/github-script@v6
-      with:
-        script: |
-          const deployment = await github.rest.repos.createDeployment({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            ref: '${{ inputs.sha }}',
-            environment: 'Staging',
-            auto_merge: false,
-            required_contexts: [],
-            description: 'Staging deployment via Vercel'
-          });
-          
-          await github.rest.repos.createDeploymentStatus({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            deployment_id: deployment.data.id,
-            state: 'success',
-            environment_url: process.env.DEPLOYMENT_URL,
-            description: '✨ Staging deployment completed'
-          });
+        echo "deployment-url=$(vercel deploy --prebuilt --token=${{ inputs.vercel-token }})" >> $GITHUB_OUTPUT

.github/actions/deployment-status/action.yml

@@ -0,0 +1,45 @@
+name: 'Update GitHub Deployment Status'
+description: 'Creates and updates GitHub deployment status'
+
+inputs:
+  environment:
+    description: 'The deployment environment (e.g., Staging, Production)'
+    required: true
+  deployment-url:
+    description: 'The URL of the deployment'
+    required: true
+  sha:
+    description: 'The commit SHA'
+    required: true
+  status:
+    description: 'The deployment status (pending, success, failure)'
+    required: true
+  description:
+    description: 'Description of the deployment status'
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Update GitHub deployment status
+      uses: actions/github-script@v6
+      with:
+        script: |
+          const deployment = await github.rest.repos.createDeployment({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            ref: '${{ inputs.sha }}',
+            environment: '${{ inputs.environment }}',
+            auto_merge: false,
+            required_contexts: [],
+            description: '${{ inputs.description }}'
+          });
+          
+          await github.rest.repos.createDeploymentStatus({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            deployment_id: deployment.data.id,
+            state: '${{ inputs.status }}',
+            environment_url: '${{ inputs.deployment-url }}',
+            description: '${{ inputs.description }}'
+          });

.github/actions/generate-app-id/action.yml

@@ -0,0 +1,17 @@
+name: 'Generate App ID'
+description: 'Generates a random app ID for preview deployments'
+
+outputs:
+  app-id:
+    description: 'The generated app ID'
+    value: ${{ steps.generate.outputs.app-id }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Generate random ID
+      id: generate
+      shell: bash
+      run: |
+        APP_ID=$(openssl rand -hex 8)
+        echo "app-id=$APP_ID" >> $GITHUB_OUTPUT

.github/actions/prepare-preview-url/action.yml

@@ -0,0 +1,25 @@
+name: 'Prepare Preview URL'
+description: 'Prepares preview URL with app ID for preview environments'
+
+inputs:
+  deployment-url:
+    description: 'Base deployment URL'
+    required: true
+  app-id:
+    description: 'App ID to append as query parameter'
+    required: true
+
+outputs:
+  url:
+    description: 'The final preview URL with app ID'
+    value: ${{ steps.prepare.outputs.url }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare URL
+      id: prepare
+      shell: bash
+      run: |
+        FINAL_URL="${{ inputs.deployment-url }}?app-id=${{ inputs.app-id }}"
+        echo "url=$FINAL_URL" >> $GITHUB_OUTPUT

.github/workflows/deploy-preview.yml

@@ -6,6 +6,11 @@ on:
       - opened
       - synchronize
 
+# Default permissions
+permissions:
+  contents: read
+  packages: read
+
 # Cancel in-progress runs for pull requests
 concurrency:
   group: preview-${{ github.ref }}
@@ -21,6 +26,9 @@ jobs:
   quality:
     name: Quality Checks
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -35,6 +43,10 @@ jobs:
     name: Deploy Preview
     needs: quality
     runs-on: ubuntu-latest
+    permissions:
+      deployments: write
+      issues: write
+      pull-requests: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -43,9 +55,41 @@ jobs:
         uses: ./.github/actions/setup-environment
 
       - name: Deploy to Vercel
+        id: deploy
         uses: ./.github/actions/deploy/vercel/development
         with:
           vercel-token: ${{ secrets.VERCEL_TOKEN }}
           vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
           vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
           pr-number: ${{ github.event.pull_request.number }}
+
+      - name: Generate app ID
+        id: generate-app-id
+        uses: ./.github/actions/generate-app-id
+
+      - name: Prepare preview URL
+        id: preview-url
+        uses: ./.github/actions/prepare-preview-url
+        with:
+          deployment-url: ${{ steps.deploy.outputs.deployment-url }}
+          app-id: ${{ steps.generate-app-id.outputs.app-id }}
+
+      - name: Add preview URL to pull request
+        uses: actions/github-script@v6
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: ${{ github.event.pull_request.number }},
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `✨ Preview deployment is ready at: ${{ steps.preview-url.outputs.url }}`
+            })
+
+      - name: Update deployment status
+        uses: ./.github/actions/deployment-status
+        with:
+          environment: 'Preview'
+          deployment-url: ${{ steps.preview-url.outputs.url }}
+          sha: ${{ github.event.pull_request.head.sha }}
+          status: 'success'
+          description: '✨ Preview deployment completed'

.github/workflows/deploy-production.yml

@@ -4,6 +4,11 @@ on:
     tags:
       - 'v*'
 
+# Default permissions
+permissions:
+  contents: read
+  packages: read
+
 # Ensure only one production deployment can run at a time
 concurrency:
   group: production
@@ -21,6 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       deployments: write
+      statuses: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -29,9 +35,19 @@ jobs:
         uses: ./.github/actions/setup-environment
 
       - name: Deploy to Vercel
+        id: deploy
         uses: ./.github/actions/deploy/vercel/production
         with:
           vercel-token: ${{ secrets.VERCEL_TOKEN }}
           vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
           vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
           sha: ${{ github.sha }}
+
+      - name: Update deployment status
+        uses: ./.github/actions/deployment-status
+        with:
+          environment: 'Production'
+          deployment-url: ${{ steps.deploy.outputs.deployment-url }}
+          sha: ${{ github.sha }}
+          status: 'success'
+          description: '✨ Production deployment completed'

.github/workflows/deploy-staging.yml

@@ -4,6 +4,11 @@ on:
     branches:
       - main
 
+# Default permissions
+permissions:
+  contents: read
+  packages: read
+
 # Ensure only one staging deployment can run at a time
 concurrency:
   group: staging
@@ -19,6 +24,9 @@ jobs:
   quality:
     name: Quality Checks
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -35,6 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       deployments: write
+      statuses: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -43,9 +52,30 @@ jobs:
         uses: ./.github/actions/setup-environment
 
       - name: Deploy to Vercel
+        id: deploy
         uses: ./.github/actions/deploy/vercel/staging
         with:
           vercel-token: ${{ secrets.VERCEL_TOKEN }}
           vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
           vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
           sha: ${{ github.sha }}
+
+      - name: Generate app ID
+        id: generate-app-id
+        uses: ./.github/actions/generate-app-id
+
+      - name: Prepare preview URL
+        id: preview-url
+        uses: ./.github/actions/prepare-preview-url
+        with:
+          deployment-url: ${{ steps.deploy.outputs.deployment-url }}
+          app-id: ${{ steps.generate-app-id.outputs.app-id }}
+
+      - name: Update deployment status
+        uses: ./.github/actions/deployment-status
+        with:
+          environment: 'Staging'
+          deployment-url: ${{ steps.preview-url.outputs.url }}
+          sha: ${{ github.sha }}
+          status: 'success'
+          description: '✨ Staging deployment completed'