fix(agentic-payments): warn that self-hosted facilitators underbid mainnet fees #298
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy PR preview | |
| # Internal-PR-only preview deployments. Each PR gets its own | |
| # subdirectory on the `gh-pages` branch (`pr/<N>/`) and a comment with | |
| # the URL. The same workflow tears the subdirectory down when the PR | |
| # closes, so previews don't accumulate. | |
| # | |
| # `SITE_ORIGIN` deliberately matches main (production), NOT the preview | |
| # URL. The hero pill, copy-pastable card URLs, and `llms.txt` show what | |
| # users will see after merge — preview URLs would die when the PR | |
| # closes and poison anything that copied them. Only `NEXT_BASE_PATH` | |
| # varies, so Next.js routes assets to the preview subpath while the | |
| # displayed content stays canonical. `IS_PREVIEW` renders a banner so | |
| # reviewers know what they're looking at. | |
| # | |
| # Fork PRs are intentionally skipped (see the `if:` guard below): they | |
| # can't safely receive the repo's GITHUB_TOKEN, and our `peaceiris` + | |
| # `rossjrw` steps need write access to push to `gh-pages` and comment. | |
| # | |
| # Concurrency: both this workflow and `deploy-pages.yml` use the shared | |
| # `gh-pages-write` group so two simultaneous pushes to `gh-pages` can't | |
| # collide. `cancel-in-progress: false` keeps each preview build to | |
| # completion; PRs in rapid succession queue rather than thrash. | |
| on: | |
| pull_request: | |
| types: [opened, reopened, synchronize, closed] | |
| branches: [main] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| concurrency: | |
| group: gh-pages-write | |
| cancel-in-progress: false | |
| defaults: | |
| run: | |
| working-directory: site | |
| jobs: | |
| preview: | |
| # Skip PRs opened from forks (no write token, can't deploy). | |
| if: github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| env: | |
| # Production origin (same as main) — see header comment. | |
| SITE_ORIGIN: ${{ vars.SITE_ORIGIN || 'https://skills.stellar.org' }} | |
| IS_PREVIEW: "true" | |
| # PR head SHA so card "view source" links resolve for newly-added | |
| # files that aren't on main yet. | |
| GITHUB_SOURCE_REF: ${{ github.event.pull_request.head.sha }} | |
| GITHUB_PR_NUMBER: ${{ github.event.number }} | |
| steps: | |
| # Explicitly check out the PR head, not the auto-generated merge | |
| # commit. The merge commit can drift from the PR's actual state | |
| # (e.g., when base advances), so building head.sha makes the | |
| # preview match exactly what was pushed to the PR. | |
| - if: github.event.action != 'closed' | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| # On `closed` events we don't build. We just need a checkout for | |
| # the cleanup step to run from. | |
| - if: github.event.action == 'closed' | |
| uses: actions/checkout@v4 | |
| # Preview-scoped basePath. The site is served from skills.stellar.org | |
| # at the apex, so previews live at `skills.stellar.org/pr/pr-<N>/`. | |
| # `rossjrw/pr-preview-action` deploys under `<umbrella-dir>/pr-<N>` | |
| # by default, so the basePath must include the `pr-` prefix on the | |
| # number to match — otherwise asset URLs baked into the HTML 404. | |
| - name: Resolve NEXT_BASE_PATH | |
| if: github.event.action != 'closed' | |
| run: echo "NEXT_BASE_PATH=/pr/pr-${{ github.event.number }}" >> "$GITHUB_ENV" | |
| - if: github.event.action != 'closed' | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.15.1 | |
| - if: github.event.action != 'closed' | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| cache-dependency-path: site/pnpm-lock.yaml | |
| - if: github.event.action != 'closed' | |
| run: pnpm install --frozen-lockfile | |
| - if: github.event.action != 'closed' | |
| run: pnpm lint | |
| - if: github.event.action != 'closed' | |
| run: pnpm lint:ts | |
| - if: github.event.action != 'closed' | |
| run: pnpm check:ecosystem-links | |
| - if: github.event.action != 'closed' | |
| run: pnpm test:ecosystem-links | |
| - if: github.event.action != 'closed' | |
| run: pnpm build | |
| - name: Verify hero text matches production SITE_ORIGIN (no PR path leak) | |
| if: github.event.action != 'closed' | |
| run: | | |
| HOST="${SITE_ORIGIN#https://}" | |
| HOST="${HOST#http://}" | |
| # Single exact-match check: requiring tag boundaries on either | |
| # side rejects subpath leaks (`pr/<N>/`, asset prefixes, etc.) | |
| # that would otherwise pass a loose `grep -qF`. | |
| if ! grep -qF ">Read ${HOST} before you start building on Stellar.<" out/index.html; then | |
| echo "::error::Hero pill text in out/index.html doesn't exactly match SITE_ORIGIN=${SITE_ORIGIN}" | |
| exit 1 | |
| fi | |
| # rossjrw/pr-preview-action@v1.8.1 pinned to commit SHA for | |
| # supply-chain safety. Bump intentionally when reviewing release | |
| # notes. Dependabot can automate this once `github-actions` | |
| # updates are enabled. | |
| - name: Deploy / remove preview | |
| uses: rossjrw/pr-preview-action@ffa7509e91a3ec8dfc2e5536c4d5c1acdf7a6de9 | |
| with: | |
| source-dir: site/out | |
| preview-branch: gh-pages | |
| umbrella-dir: pr | |
| action: auto |