new deploy flow

Author: databasedav

.github/workflows/build_example.yaml

@@ -7,6 +7,9 @@ jobs:
     - name: checkout repo
       uses: actions/checkout@v4
       with:
+        persist-credentials: false
+        ref: ${{ inputs.ref || github.sha }}
+        repository: ${{ inputs.repository || github.repository }}
         submodules: true
     - name: install rust toolchain
       uses: dtolnay/rust-toolchain@master
@@ -45,7 +48,7 @@ jobs:
       with:
         name: ${{ inputs.api }}_${{ inputs.example }}
         path: dist
-name: build_example
+name: build example
 on:
   workflow_call:
     inputs:
@@ -55,3 +58,9 @@ on:
       example:
         required: true
         type: string
+      ref:
+        required: false
+        type: string
+      repository:
+        required: false
+        type: string

.github/workflows/ci.yaml

@@ -4,13 +4,14 @@ env:
   RUSTDOCFLAGS: --deny warnings
   RUSTFLAGS: --deny warnings
 jobs:
-  assert_nickels_synced_:
-    name: assert_nickels_synced_
+  assert_nickels_synced:
+    name: assert nickels synced
     runs-on: ubuntu-latest
     steps:
     - name: checkout repo
       uses: actions/checkout@v4
       with:
+        persist-credentials: false
         submodules: true
     - name: install nickel
       run: |-
@@ -24,16 +25,17 @@ jobs:
       uses: extractions/setup-just@v2
     - name: assert nickels synced
       run: |-
-        just sync_nickels
+        just format_nickels sync_nickels
         [[ -n $(git status --porcelain) ]] && echo 'nickels are not synced; run `just format_nickels sync_nickels`' && exit 1 || exit 0
   check_all_features:
-    name: check_all_features
-    needs: assert_nickels_synced_
+    name: check all features
+    needs: assert_nickels_synced
     runs-on: ubuntu-latest
     steps:
     - name: checkout repo
       uses: actions/checkout@v4
       with:
+        persist-credentials: false
         submodules: true
     - name: install rust toolchain
       uses: dtolnay/rust-toolchain@master
@@ -56,12 +58,13 @@ jobs:
       run: just check_all_features
   clippy:
     name: clippy
-    needs: assert_nickels_synced_
+    needs: assert_nickels_synced
     runs-on: ubuntu-latest
     steps:
     - name: checkout repo
       uses: actions/checkout@v4
       with:
+        persist-credentials: false
         submodules: true
     - name: install rust toolchain
       uses: dtolnay/rust-toolchain@master
@@ -81,12 +84,13 @@ jobs:
       run: just clippy
   docs:
     name: docs
-    needs: assert_nickels_synced_
+    needs: assert_nickels_synced
     runs-on: ubuntu-latest
     steps:
     - name: checkout repo
       uses: actions/checkout@v4
       with:
+        persist-credentials: false
         submodules: true
     - name: install rust toolchain
       uses: dtolnay/rust-toolchain@master
@@ -105,12 +109,13 @@ jobs:
       run: just doc
   format:
     name: format
-    needs: assert_nickels_synced_
+    needs: assert_nickels_synced
     runs-on: ubuntu-latest
     steps:
     - name: checkout repo
       uses: actions/checkout@v4
       with:
+        persist-credentials: false
         submodules: true
     - name: install rust toolchain
       uses: dtolnay/rust-toolchain@master
@@ -123,12 +128,13 @@ jobs:
       run: just format -- --check
   test:
     name: test
-    needs: assert_nickels_synced_
+    needs: assert_nickels_synced
     runs-on: ubuntu-latest
     steps:
     - name: checkout repo
       uses: actions/checkout@v4
       with:
+        persist-credentials: false
         submodules: true
     - name: install rust toolchain
       uses: dtolnay/rust-toolchain@master

.github/workflows/cleanup_pr_previews.yaml

@@ -2,13 +2,30 @@
 env:
   PR: ${{ github.event.pull_request.number }}
 jobs:
+  cancel_deployments:
+    concurrency:
+      cancel-in-progress: true
+      group: pr-preview-${{ github.event.pull_request.number }}
+    name: cancel deployments
+    permissions: {}
+    runs-on: ubuntu-latest
+    steps:
+    - name: cancel in-progress preview deployments
+      run: 'true'
   cleanup:
+    concurrency:
+      cancel-in-progress: true
+      group: pr-preview-cleanup-${{ github.event.pull_request.number }}
     name: cleanup
+    needs: cancel_deployments
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
     - name: checkout repo
       uses: actions/checkout@v4
       with:
+        persist-credentials: false
         submodules: true
     - name: make empty dir
       run: mkdir -p empty_dir
@@ -20,10 +37,8 @@ jobs:
         folder: empty_dir
         single-commit: true
         target-folder: pr_previews/${{ env.PR }}
-name: cleanup_pr_previews
+name: cleanup pr previews
 on:
   pull_request_target:
     types:
     - closed
-permissions:
-  contents: write