Codechange: [CI] Use unprivileged env to build preview (#15419)

.github/workflows/preview-build.yml

@@ -2,22 +2,11 @@ name: Preview build
 
 on:
   workflow_call:
-    secrets:
-      PREVIEW_CLOUDFLARE_API_TOKEN:
-        description: API token to upload a preview to Cloudflare Pages
-        required: true
-      PREVIEW_CLOUDFLARE_ACCOUNT_ID:
-        description: Account ID to upload a preview to Cloudflare Pages
-        required: true
 
 jobs:
   preview:
     name: Build preview
 
-    environment:
-      name: preview
-      url: https://preview.openttd.org/pr${{ github.event.pull_request.number }}/
-
     runs-on: ubuntu-latest
     container:
       # If you change this version, change the numbers in the cache step,
@@ -97,16 +86,14 @@ jobs:
         cp build/openttd.js public/
         cp build/openttd.wasm public/
 
-        # Ensure we use the latest version of npm; the one we get with current
-        # emscripten doesn't allow running "npx wrangler" as root.
-        # Current emscripten can't install npm>=10.0.0 because node is too old.
-        npm install -g npm@9
+        mkdir pr
+        echo ${{ github.event.pull_request.number }} > ./pr/number
 
-    - name: Publish preview
-      uses: cloudflare/pages-action@v1
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v6
       with:
-        apiToken: ${{ secrets.PREVIEW_CLOUDFLARE_API_TOKEN }}
-        accountId: ${{ secrets.PREVIEW_CLOUDFLARE_ACCOUNT_ID }}
-        projectName: ${{ vars.PREVIEW_CLOUDFLARE_PROJECT_NAME }}
-        directory: public
-        branch: pr${{ github.event.pull_request.number }}
+        name: pr${{ github.event.pull_request.number }}
+        path: |
+          public
+          pr
+        retention-days: 1

.github/workflows/preview-publish.yml

@@ -0,0 +1,51 @@
+name: Preview publish
+
+on:
+  workflow_run:
+    workflows:
+    - Preview
+    types:
+    - completed
+
+jobs:
+  preview:
+    name: Publish preview
+
+    environment:
+      name: preview
+      url: https://preview.openttd.org/pr${{ steps.pr.outputs.number }}/
+
+    runs-on: ubuntu-latest
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+
+    steps:
+    - name: Download artifacts
+      uses: actions/download-artifact@v8
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        run-id: ${{github.event.workflow_run.id }}
+
+    - name: Get PR number
+      id: pr
+      run: |
+        echo "number=$(cat pr/number)" >> $GITHUB_OUTPUT
+
+    - name: Publish preview
+      uses: cloudflare/wrangler-action@v3
+      with:
+        apiToken: ${{ secrets.PREVIEW_CLOUDFLARE_API_TOKEN }}
+        accountId: ${{ secrets.PREVIEW_CLOUDFLARE_ACCOUNT_ID }}
+        command: pages deploy public --project-name=${{ vars.PREVIEW_CLOUDFLARE_PROJECT_NAME }} --branch pr${{ steps.pr.outputs.number }}
+
+    - name: Report status
+      if: always()
+      run: |
+        curl -L \
+        -X POST \
+        -H "Accept: application/vnd.github+json" \
+        -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+        -H "X-GitHub-Api-Version: 2026-03-10" \
+        https://api.github.com/repos/${{ github.repository }}/statuses/${{ github.event.workflow_run.head_sha }} \
+        -d '{"state":"${{ job.status }}","target_url":"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}","context":"Publish preview"}'

.github/workflows/preview.yml

@@ -1,7 +1,7 @@
 name: Preview
 
 on:
-  pull_request_target:
+  pull_request:
     types:
     - labeled
     - synchronize