tower / commit
docs(decisions): how branch previews are refreshed (D-073)
decisions.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/decisions.md b/decisions.md index dcc8dd2..9b5b162 100644 --- a/decisions.md +++ b/decisions.md @@ -2407,7 +2407,12 @@ recovered by hand. but they are Premium-only and this project is on the Free plan. So the default branch's pipeline builds every branch into one site (`tools/build-pages.sh`): the default branch at the root, each other branch in a folder named for it. A push to any other branch triggers -a default-branch pipeline, so its preview follows it within minutes. A branch that fails +a default-branch pipeline, so its preview follows it within minutes. That goes through the +pipeline trigger API with a trigger token kept in the masked CI/CD variable +`PAGES_TRIGGER_TOKEN`: a `trigger:` job cannot start a pipeline in its own project, which +is how the first attempt failed (`invalid_bridge_trigger`). The token acts with the +author's permissions and cannot be limited to protected branches, since previews come from +unprotected ones; acceptable while the author is the only one who pushes. A branch that fails to build is left out with a warning rather than failing the deploy, so a broken experiment can never take the published map down.