From 90631494ebaf5a8b3a67d858bd3a5f858a1a1cb5 Mon Sep 17 00:00:00 2001
From: Tobias Leander <tobias@toblea.com>
Date: Tue, 18 Aug 2026 11:29:20 +0200
Subject: [PATCH 1/4] Add new jobs

---
 .github/workflows/build-main.yml    | 49 +++++++++++++++++
 .github/workflows/build-preview.yml | 85 +++++++++++++++++++++++++++++
 2 files changed, 134 insertions(+)
 create mode 100644 .github/workflows/build-main.yml
 create mode 100644 .github/workflows/build-preview.yml

diff --git a/.github/workflows/build-main.yml b/.github/workflows/build-main.yml
new file mode 100644
index 000000000..97b194a1c
--- /dev/null
+++ b/.github/workflows/build-main.yml
@@ -0,0 +1,49 @@
+name: Build and deploy master
+permissions:
+  id-token: write
+  contents: write
+on:
+#  push:
+#    branches:
+#      - master
+  workflow_dispatch:
+
+env:
+  AWS_REGION: "us-east-1"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Git clone the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c #v6.2.3
+        with:
+          role-to-assume: arn:aws:iam::389712312597:role/Stitch
+          role-session-name: GitHub_to_AWS_via_FederationOIDC
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.1'
+          bundler-cache: true
+
+      - name: Build Jekyll site
+        run: bundle exec jekyll build
+        env:
+          JEKYLL_ENV: production
+
+      - name: Upload to AWS
+        run: |
+          aws sts get-caller-identity
+          aws s3 sync ./_site s3://qlikhelp-stitch --delete 
+          # aws cloudfront create-invalidation --distribution-id ECSW2C236F46Q --paths "/*"
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: site
+          path: _site/
diff --git a/.github/workflows/build-preview.yml b/.github/workflows/build-preview.yml
new file mode 100644
index 000000000..a252e38e2
--- /dev/null
+++ b/.github/workflows/build-preview.yml
@@ -0,0 +1,85 @@
+name: Build and deploy PR to preview
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write
+on:
+  workflow_dispatch:
+    inputs:
+      pr:
+        description: "Which Pull Request to publish"
+        required: true
+  #pull_request:
+  #  types: [opened, reopened, synchronize, closed]
+
+env:
+  AWS_REGION: "us-east-1"
+  PREVIEW_DOMAIN: "dyokhwe5tb1zx.cloudfront.net"
+  PR_NUMBER: ${{ github.event.inputs.pr }} # ${{ github.event.pull_request.number }}
+
+concurrency:
+  group: preview-${{ github.event.inputs.pr }}
+  cancel-in-progress: true
+
+jobs:
+  deploy-preview:
+    # Fork PRs don't get AWS credentials, so skip them explicitly rather than let the job fail
+    # if: github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+    - name: Git clone the repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c #v6.2.3
+      with:
+        role-to-assume: arn:aws:iam::389712312597:role/Stitch
+        role-session-name: GitHub_to_AWS_via_FederationOIDC
+        aws-region: ${{ env.AWS_REGION }}
+
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: '3.1'
+        bundler-cache: true
+
+    - name: Build Jekyll site
+      run: bundle exec jekyll build --baseurl /pr-${{ env.PR_NUMBER }}
+      env:
+        JEKYLL_ENV: production
+
+    - name: Upload preview to AWS
+      run: |
+        aws sts get-caller-identity
+        aws s3 sync ./_site/docs s3://qlikhelp-stitch-preview/pr-${{ env.PR_NUMBER }} --delete
+        aws cloudfront create-invalidation --distribution-id E1U35C0N5TLHYJ --paths "/*"
+
+    - name: Comment preview info on PR
+      uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+      with:
+        number: ${{ env.PR_NUMBER }}
+        message: |
+          ### 📖 Preview deployed
+          S3 path: `s3://qlikhelp-stitch-preview/pr-${{ env.PR_NUMBER }}/`
+
+          [https://dyokhwe5tb1zx.cloudfront.net/pr-${{ env.PR_NUMBER }}/](https://dyokhwe5tb1zx.cloudfront.net/pr-${{ env.PR_NUMBER }}/)
+
+  cleanup-preview:
+    # if: github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c #v6.2.3
+      with:
+        role-to-assume: arn:aws:iam::389712312597:role/Stitch
+        role-session-name: GitHub_to_AWS_via_FederationOIDC
+        aws-region: ${{ env.AWS_REGION }}
+
+    - name: Remove preview from AWS
+      run: aws s3 rm s3://qlikhelp-stitch-preview/pr-${{ env.PR_NUMBER }} --recursive
+
+    - name: Update PR comment
+      uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+      with:
+        number: ${{ env.PR_NUMBER }}
+        message: 🗑️ Preview removed.

From b368fe1b47db55e0a338e75e99d81699d5d8e432 Mon Sep 17 00:00:00 2001
From: Tobias Leander <tobias@toblea.com>
Date: Tue, 18 Aug 2026 13:20:32 +0200
Subject: [PATCH 2/4] Fixes

---
 .github/workflows/build-main.yml    |  4 +-
 .github/workflows/build-preview.yml | 86 ++++++++++++++---------------
 2 files changed, 45 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/build-main.yml b/.github/workflows/build-main.yml
index 97b194a1c..ac9426977 100644
--- a/.github/workflows/build-main.yml
+++ b/.github/workflows/build-main.yml
@@ -1,7 +1,7 @@
 name: Build and deploy master
 permissions:
   id-token: write
-  contents: write
+  contents: read
 on:
 #  push:
 #    branches:
@@ -39,7 +39,7 @@ jobs:
       - name: Upload to AWS
         run: |
           aws sts get-caller-identity
-          aws s3 sync ./_site s3://qlikhelp-stitch --delete 
+          aws s3 sync ./_site s3://qlikhelp-stitch --delete
           # aws cloudfront create-invalidation --distribution-id ECSW2C236F46Q --paths "/*"
 
       - name: Upload build artifact
diff --git a/.github/workflows/build-preview.yml b/.github/workflows/build-preview.yml
index a252e38e2..476892176 100644
--- a/.github/workflows/build-preview.yml
+++ b/.github/workflows/build-preview.yml
@@ -27,59 +27,59 @@ jobs:
     # if: github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
-    - name: Git clone the repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+      - name: Git clone the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
 
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c #v6.2.3
-      with:
-        role-to-assume: arn:aws:iam::389712312597:role/Stitch
-        role-session-name: GitHub_to_AWS_via_FederationOIDC
-        aws-region: ${{ env.AWS_REGION }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c #v6.2.3
+        with:
+          role-to-assume: arn:aws:iam::389712312597:role/Stitch
+          role-session-name: GitHub_to_AWS_via_FederationOIDC
+          aws-region: ${{ env.AWS_REGION }}
 
-    - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: '3.1'
-        bundler-cache: true
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.1'
+          bundler-cache: true
 
-    - name: Build Jekyll site
-      run: bundle exec jekyll build --baseurl /pr-${{ env.PR_NUMBER }}
-      env:
-        JEKYLL_ENV: production
+      - name: Build Jekyll site
+        run: bundle exec jekyll build --baseurl /pr-${{ env.PR_NUMBER }}
+        env:
+          JEKYLL_ENV: production
 
-    - name: Upload preview to AWS
-      run: |
-        aws sts get-caller-identity
-        aws s3 sync ./_site/docs s3://qlikhelp-stitch-preview/pr-${{ env.PR_NUMBER }} --delete
-        aws cloudfront create-invalidation --distribution-id E1U35C0N5TLHYJ --paths "/*"
+      - name: Upload preview to AWS
+        run: |
+          aws sts get-caller-identity
+          aws s3 sync ./_site/docs s3://qlikhelp-stitch-preview/pr-${{ env.PR_NUMBER }} --delete
+          aws cloudfront create-invalidation --distribution-id E1U35C0N5TLHYJ --paths "/*"
 
-    - name: Comment preview info on PR
-      uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
-      with:
-        number: ${{ env.PR_NUMBER }}
-        message: |
-          ### 📖 Preview deployed
-          S3 path: `s3://qlikhelp-stitch-preview/pr-${{ env.PR_NUMBER }}/`
+      - name: Comment preview info on PR
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+        with:
+          number: ${{ env.PR_NUMBER }}
+          message: |
+            ### 📖 Preview deployed
+            S3 path: `s3://qlikhelp-stitch-preview/pr-${{ env.PR_NUMBER }}/`
 
-          [https://dyokhwe5tb1zx.cloudfront.net/pr-${{ env.PR_NUMBER }}/](https://dyokhwe5tb1zx.cloudfront.net/pr-${{ env.PR_NUMBER }}/)
+            [https://${{ env.PREVIEW_DOMAIN }}/pr-${{ env.PR_NUMBER }}/](https://${{ env.PREVIEW_DOMAIN }}/pr-${{ env.PR_NUMBER }}/)
 
   cleanup-preview:
     # if: github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c #v6.2.3
-      with:
-        role-to-assume: arn:aws:iam::389712312597:role/Stitch
-        role-session-name: GitHub_to_AWS_via_FederationOIDC
-        aws-region: ${{ env.AWS_REGION }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c #v6.2.3
+        with:
+          role-to-assume: arn:aws:iam::389712312597:role/Stitch
+          role-session-name: GitHub_to_AWS_via_FederationOIDC
+          aws-region: ${{ env.AWS_REGION }}
 
-    - name: Remove preview from AWS
-      run: aws s3 rm s3://qlikhelp-stitch-preview/pr-${{ env.PR_NUMBER }} --recursive
+      - name: Remove preview from AWS
+        run: aws s3 rm s3://qlikhelp-stitch-preview/pr-${{ env.PR_NUMBER }} --recursive
 
-    - name: Update PR comment
-      uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
-      with:
-        number: ${{ env.PR_NUMBER }}
-        message: 🗑️ Preview removed.
+      - name: Update PR comment
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+        with:
+          number: ${{ env.PR_NUMBER }}
+          message: 🗑️ Preview removed.

From be90c97b9445d3ecfbe6064ee67eea91d1d6a983 Mon Sep 17 00:00:00 2001
From: Tobias Leander <tobias@toblea.com>
Date: Tue, 18 Aug 2026 13:45:55 +0200
Subject: [PATCH 3/4] Automatically builds instead

---
 .github/workflows/build-main.yml    |  8 ++++----
 .github/workflows/build-preview.yml | 18 +++++++++---------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/build-main.yml b/.github/workflows/build-main.yml
index ac9426977..0d48ecdc0 100644
--- a/.github/workflows/build-main.yml
+++ b/.github/workflows/build-main.yml
@@ -3,10 +3,10 @@ permissions:
   id-token: write
   contents: read
 on:
-#  push:
-#    branches:
-#      - master
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+#  workflow_dispatch:
 
 env:
   AWS_REGION: "us-east-1"
diff --git a/.github/workflows/build-preview.yml b/.github/workflows/build-preview.yml
index 476892176..a8a83ee2f 100644
--- a/.github/workflows/build-preview.yml
+++ b/.github/workflows/build-preview.yml
@@ -4,21 +4,21 @@ permissions:
   contents: read
   pull-requests: write
 on:
-  workflow_dispatch:
-    inputs:
-      pr:
-        description: "Which Pull Request to publish"
-        required: true
-  #pull_request:
-  #  types: [opened, reopened, synchronize, closed]
+  #workflow_dispatch:
+  #  inputs:
+  #    pr:
+  #      description: "Which Pull Request to publish"
+  #      required: true
+  pull_request:
+    types: [opened, reopened, synchronize, closed]
 
 env:
   AWS_REGION: "us-east-1"
   PREVIEW_DOMAIN: "dyokhwe5tb1zx.cloudfront.net"
-  PR_NUMBER: ${{ github.event.inputs.pr }} # ${{ github.event.pull_request.number }}
+  PR_NUMBER: ${{ github.event.pull_request.number }} # ${{ github.event.inputs.pr }}
 
 concurrency:
-  group: preview-${{ github.event.inputs.pr }}
+  group: preview-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
 jobs:

From 3b20889315b3b340799efe611a29d4d00fdc9117 Mon Sep 17 00:00:00 2001
From: Tobias Leander <tobias@toblea.com>
Date: Tue, 18 Aug 2026 13:46:56 +0200
Subject: [PATCH 4/4] Re-add exit points

---
 .github/workflows/build-preview.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-preview.yml b/.github/workflows/build-preview.yml
index a8a83ee2f..e0e7b11a6 100644
--- a/.github/workflows/build-preview.yml
+++ b/.github/workflows/build-preview.yml
@@ -24,7 +24,7 @@ concurrency:
 jobs:
   deploy-preview:
     # Fork PRs don't get AWS credentials, so skip them explicitly rather than let the job fail
-    # if: github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository
+    if: github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Git clone the repository
@@ -65,7 +65,7 @@ jobs:
             [https://${{ env.PREVIEW_DOMAIN }}/pr-${{ env.PR_NUMBER }}/](https://${{ env.PREVIEW_DOMAIN }}/pr-${{ env.PR_NUMBER }}/)
 
   cleanup-preview:
-    # if: github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
+    if: github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Configure AWS credentials