Re-enable isolated build deployment write on elastic/docs-builder

[Mpdreamz]

Why

Deployment creation and status updates were disabled with if: false gates left over from initial workflow setup. With S3 uploads now active, GitHub deployment status should reflect the actual preview state so contributors and reviewers can see deployment links directly on the PR.

What

Re-enables the Create Deployment and Update deployment status steps by removing the if: false guards, and grants the build job deployments: write permission.

Also adds explicit head.repo.full_name == github.repository fork checks to the aws-auth and s3-upload steps so that fork PR safety does not rely solely on the upstream step dependency chain.

[coderabbitai]

Warning

Rate limit exceeded

@Mpdreamz has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 55 minutes and 37 seconds before requesting another review.

To continue reviewing without waiting, purchase usage credits in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d072e529-cd74-431a-952d-d1081473fc91

📥 Commits

Reviewing files that changed from the base of the PR and between b18465d and 0cb770d.

📒 Files selected for processing (1)

• .github/workflows/docs-preview-local.yml

📝 Walkthrough

Walkthrough

This PR makes two complementary changes to the deployment infrastructure. The workflow file enables deployment operations by granting the build job write permission to the deployments API and removing disabled guard conditions that were preventing deployment and status update steps from executing. Separately, the CLI apply command is extended to accept plan files with either .json or .plan extensions, broadening the input formats supported by the deployment apply flow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: re-enabling deployment write functionality in the workflow, which directly aligns with the changeset's primary purpose.
Description check	✅ Passed	The description is directly related to the changeset, clearly explaining the motivation (S3 uploads now active, need deployment status) and what was changed (re-enabling deployment steps, adding fork guards).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch re-enable-isolated-build-deployments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/docs-preview-local.yml (1)

218-255: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

"Create Deployment" will fail noisily for fork PRs.

github.event.repository.fork refers to the base repo (elastic/docs-builder), which is never a fork, so the build job's top-level guard (if: github.event.repository.fork == false) doesn't exclude fork PRs. For pull_request events from forks, GitHub restricts the GITHUB_TOKEN to read-only regardless of what permissions declares — the createDeployment call will 403, producing a failed step in every fork contributor's CI run.

All other sensitive steps already carry the correct guard. Adding it here makes this consistent:

🔧 Proposed fix

      - name: Create Deployment
        if: >
          env.MATCH == 'true'
          && needs.check.outputs.any_modified != 'false'
          && (
            github.event_name == 'push'
            || github.event_name == 'pull_request'
          )
+         && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docs-preview-local.yml around lines 218 - 255, The "Create
Deployment" step (id: deployment, uses: actions/github-script@v8) must skip
forked pull requests to avoid 403 from createDeployment/createDeploymentStatus;
update the step's if condition to additionally require that for pull_request
events the PR head repo is not a fork (e.g. add "&& (github.event_name !=
'pull_request' || github.event.pull_request.head.repo.fork == false)") so the
script only runs when the PR head repository is not a fork.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/docs-preview-local.yml:
- Around line 218-255: The "Create Deployment" step (id: deployment, uses:
actions/github-script@v8) must skip forked pull requests to avoid 403 from
createDeployment/createDeploymentStatus; update the step's if condition to
additionally require that for pull_request events the PR head repo is not a fork
(e.g. add "&& (github.event_name != 'pull_request' ||
github.event.pull_request.head.repo.fork == false)") so the script only runs
when the PR head repository is not a fork.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e99812a3-e988-492c-ae9e-44a0ac42161e

📥 Commits

Reviewing files that changed from the base of the PR and between 1f21de9 and b18465d.

📒 Files selected for processing (2)

• .github/workflows/docs-preview-local.yml
• src/tooling/docs-builder/Commands/Assembler/DeployCommands.cs