From 97125a1fcbf408ab10d7ea99cd593f48ed94f75d Mon Sep 17 00:00:00 2001
From: Matej Novotny <manovotn@ibm.com>
Date: Fri, 14 Aug 2026 10:57:38 +0200
Subject: [PATCH] Make PR preview workflow more robust

---
 .github/workflows/pr-preview.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index a3f8fe2..ac46ddc 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -33,23 +33,31 @@ jobs:
           run-id: ${{ github.event.workflow_run.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Read PR number
+      - name: Read and validate PR number
         id: pr
-        run: echo "number=$(cat pr-number.txt)" >> "$GITHUB_OUTPUT"
+        run: |
+          PR_NUM=$(cat pr-number.txt)
+          if ! [[ "$PR_NUM" =~ ^[0-9]+$ ]]; then
+            echo "::error::Invalid PR number: '$PR_NUM'"
+            exit 1
+          fi
+          echo "number=$PR_NUM" >> "$GITHUB_OUTPUT"
 
       - name: Install Surge
         run: npm install -g surge
 
       - name: Deploy to Surge
-        run: surge ./site ${{ env.PREVIEW_URL }} --token ${{ secrets.WEB_PREVIEW_TOKEN_SURGE }}
+        run: surge ./site "$PREVIEW_URL" --token ${{ secrets.WEB_PREVIEW_TOKEN_SURGE }}
         env:
           PREVIEW_URL: pr-${{ steps.pr.outputs.number }}-weld-site.surge.sh
 
       - name: Comment on PR
         uses: actions/github-script@v9
+        env:
+          PR_NUMBER: ${{ steps.pr.outputs.number }}
         with:
           script: |
-            const prNumber = ${{ steps.pr.outputs.number }};
+            const prNumber = parseInt(process.env.PR_NUMBER, 10);
             const previewUrl = `https://pr-${prNumber}-weld-site.surge.sh`;
             const body = `A preview of this PR is available at ${previewUrl}`;
             const { data: comments } = await github.rest.issues.listComments({