Build PR previews without maintainer approval

[st0012]

Fork previews currently pause each fork update in fork-preview-protection until a maintainer approves the environment deployment. This creates repeated approval requests, delays contributor feedback, and fills the Actions UI with waiting jobs.

This change removes the preview-specific maintainer approval step. Every PR builds RDoc in a read-only workflow that has no secrets. A trusted workflow_run matches the _site artifact to the current PR head and rejects non-static Pages controls.

flowchart LR
  subgraph untrusted["Untrusted PR workflow — no secrets"]
    PR["PR opened or updated"]
    Build["Build RDoc automatically<br/>No preview approval gate"]
    Artifact["Upload _site artifact"]

    PR --> Build --> Artifact
  end

  subgraph trusted["Trusted repository workflow"]
    Validate{"Current PR and SHA?<br/>Static artifact only?"}
    Stop["Stop"]
    Deploy["Deploy to Cloudflare Pages"]
    Comment["Update one preview comment"]

    Validate -->|No| Stop
    Validate -->|Yes| Deploy --> Comment
  end

  Artifact --> Validate
  Secrets[("Cloudflare secrets")] --> Deploy

Loading

Contributors now receive an updated preview after each successful commit. Per-PR concurrency cancels older work, and one bot comment points to the latest successful preview. Maintainers no longer open individual environment deployments or receive repeated preview approval requests.

The trusted workflow exposes the Cloudflare token only to the deployment step. It does not download the PR repository or run PR code. GitHub's separate public-fork policy can still hold workflows from contributors who are new to GitHub. Existing PRs can retain the old MATZBOT comment once. Later deployments update only the new GitHub Actions comment.

[skatkov]

Thanks!

Nice way to preview changes