Skip to content

fix(.github/workflows/deploy-docs.yaml): drop self-trigger from paths#25285

Merged
nickvigilante merged 1 commit into
mainfrom
vigilante/docs-124-remove-deploy-docs-self-trigger
May 15, 2026
Merged

fix(.github/workflows/deploy-docs.yaml): drop self-trigger from paths#25285
nickvigilante merged 1 commit into
mainfrom
vigilante/docs-124-remove-deploy-docs-self-trigger

Conversation

@nickvigilante
Copy link
Copy Markdown
Contributor

Edits to .github/workflows/deploy-docs.yaml previously self-triggered the workflow on push to main and release/* because the file was listed in its own paths:. On 2026-05-12, this caused merge of #25049 to fire a production reindex with no docs/** changes, which entered the empty-paths_json whole-branch path in the Algolia handler and wiped the docs index (see DOCS-121).

This change removes .github/workflows/deploy-docs.yaml from paths: so the workflow only runs against real docs content. Reindexes from a workflow edit alone now require workflow_dispatch, which already accepts a ref input and an action choice of index or delete. The other safety net (a workflow-level paths_json=[] guard in algolia-and-isr) is tracked separately in DOCS-122.

Refs DOCS-121, DOCS-122, DOCS-124.


Coder Agents on behalf of @nickvigilante.

Editing this workflow no longer auto-fires a production Algolia reindex.
Reindexes now require a docs/** change or manual workflow_dispatch.

Refs DOCS-121, DOCS-122, DOCS-124.
@nickvigilante
Copy link
Copy Markdown
Contributor Author

/coder-agents-review

Copy link
Copy Markdown
Contributor

@coder-agents-review coder-agents-review Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean incident response. A 4-line patch that removes the self-trigger from deploy-docs.yaml's paths: filter, fixing the root cause of DOCS-121 (production Algolia index wipe). Eight reviewers examined the change; none found a code defect. The fix is proportional, the comment is informative, and the handler-side guard is properly deferred to DOCS-122.

Three Notes below, all advisory.

"I tried to build a case against this and couldn't. The problem is correctly understood, the solution is proportional, and the fix is at the right causal level." (Pariston)

🤖 This review was automatically generated with Coder Agents.

Comment thread .github/workflows/deploy-docs.yaml
@@ -31,8 +31,10 @@ on:
- main
- "release/*"
paths:
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note [DEREM-2] The self-reference that caused DOCS-121 was introduced by PR #25049 (merged May 12), which added the paths: entry while simultaneously writing the changes job that falls back to whole-branch reindex on empty diff. The agent had the information to predict this failure mode but did not trace the "workflow-only change" execution path. (Mafu-san)

🤖

Comment thread .github/workflows/deploy-docs.yaml
@nickvigilante
Copy link
Copy Markdown
Contributor Author

/coder-agents-review

Copy link
Copy Markdown
Contributor

@coder-agents-review coder-agents-review Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-review, no new findings. Four reviewers (Mafu-san, Mafuuu, Pariston, Meruem) verified prior findings and author responses.

DEREM-1 closed: author filed DOCS-129 and shipped a full sibling audit in PR #25288 (removed docs-ci.yaml self-ref, added comments to kept refs). DEREM-3 closed: DOCS-122 confirmed High/active with a contract test in coder.com#777. DEREM-2 remains an open Note (process observation, no action requested).

Mafuuu noted that the header comment ("whenever this branch's docs/** content changes") was previously dishonest because the workflow also triggered on its own edits; the trigger now matches the stated contract.

"I tried to build a case against this change and could not." (Pariston, for the second time)

🤖 This review was automatically generated with Coder Agents.

@nickvigilante nickvigilante marked this pull request as ready for review May 14, 2026 16:19
Copy link
Copy Markdown
Contributor

Security review (on behalf of @jdomeracki-coder, generated by Coder Agents)

No blocking security issues. This is a positive security fix.

Observations:

  • Removing the self-trigger closes the accidental-DoS vector from DOCS-121 where a workflow-only edit could trigger a production reindex with empty paths_json, hitting the whole-branch fallback path. Good incident remediation.
  • The workflow_dispatch escape hatch is the correct mechanism for intentional reindexes of workflow changes. The existing input validation in the algolia-and-isr job (newline rejection, action allowlist, ref pattern allowlist, main-delete guard) remains intact and solid.
  • The inline comment referencing DOCS-121 and DOCS-124 provides useful context for future maintainers.

@nickvigilante nickvigilante merged commit 81b6132 into main May 15, 2026
36 checks passed
@nickvigilante nickvigilante deleted the vigilante/docs-124-remove-deploy-docs-self-trigger branch May 15, 2026 12:48
@github-actions github-actions Bot locked and limited conversation to collaborators May 15, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants