Merge pull request #1709 from jellyfin/fix-workflow-security

Isolate PR build from secrets and token permissions

.github/workflows/__build.yml

@@ -0,0 +1,41 @@
+name: Build
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+      upload-pages-artifact:
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: ${{ inputs.ref }}
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        with:
+          node-version: 20
+      - name: Configure Pages
+        if: inputs.upload-pages-artifact
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
+      - name: Run build
+        run: |
+          npm ci --no-audit
+          npm run build
+      - name: Upload artifact
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: jellyfin-org__build
+          path: build
+      - name: Upload pages artifact
+        if: inputs.upload-pages-artifact
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
+        with:
+          path: build

.github/workflows/build.yml

@@ -9,44 +9,20 @@ on:
   push:
     branches: [master]
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 jobs:
   build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
-        with:
-          cache: npm
-          node-version: 20
-      - name: Configure Pages
-        if: github.event_name == 'push' && github.repository == 'jellyfin/jellyfin.org'
-        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
-      - name: Run build
-        run: |
-          npm ci --no-audit
-          npm run build
-      - name: Upload artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
-        with:
-          name: jellyfin-org__build
-          path: build
-      - name: Upload pages artifact
-        if: github.event_name == 'push' && github.repository == 'jellyfin/jellyfin.org'
-        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
-        with:
-          path: build
+    uses: ./.github/workflows/__build.yml
+    permissions: {}
+    with:
+      ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      upload-pages-artifact: ${{ github.event_name == 'push' && github.repository == 'jellyfin/jellyfin.org' }}
 
   deploy:
     if: github.event_name == 'push' && github.repository == 'jellyfin/jellyfin.org'
     name: Deploy to GitHub Pages
+    permissions:
+      pages: write
+      id-token: write
     concurrency: build-deploy-pages
     environment:
       name: github-pages