fix(security): PR Previews from Forks

.github/workflows/build-preview.yml

@@ -0,0 +1,32 @@
+name: "Build Preview Deployment"
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  build-preview:
+    runs-on: "ubuntu-latest"
+    name: "Build Preview Site and Upload Build Artifact"
+    steps:
+      - name: "checkout"
+        uses: "actions/checkout@v4"
+        with:
+          fetch-depth: 0
+      - name: "setup pnpm"
+        uses: "pnpm/action-setup@v4"
+      - name: "setup node"
+        uses: "actions/setup-node@v4"
+        with:
+          cache: "pnpm"
+          node-version: 20
+      - name: "install dependencies"
+        run: "pnpm install"
+      - name: "build"
+        run: "pnpm run build"
+      # Uploads the build directory as a workflow artifact
+      - name: "upload build artifact"
+        uses: "actions/upload-artifact@v4"
+        with:
+          name: "preview-build"
+          path: "build"

.github/workflows/deploy-preview.yml

@@ -0,0 +1,38 @@
+name: "Upload Preview Deployment"
+on:
+  workflow_run:
+    workflows: ["Build Preview Deployment"]
+    types:
+      - completed
+
+permissions:
+  actions: read
+  deployments: write
+  contents: read
+  pull-requests: write
+
+jobs:
+  deploy-preview:
+    runs-on: "ubuntu-latest"
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    name: "Deploy Preview to Cloudflare Pages"
+    steps:
+      # Downloads the build directory from the previous workflow
+      - name: "download build artifact"
+        uses: "actions/download-artifact@v4"
+        id: "preview-build-artifact"
+        with:
+          name: "preview-build"
+          path: "build"
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: "publish (push)"
+        uses: "AdrianGonz97/refined-cf-pages-action@v1"
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          projectName: "papermc-website"
+          deploymentName: "Preview"
+          directory: ${{ steps.preview-build-artifact.outputs.download-path }}