PyTorch fixes docs preview upload for fork PRs using workflow_run
PyTorch solves OIDC authentication hurdle for external contributor docs previews
PyTorch's infrastructure team addressed a significant limitation in its documentation preview pipeline. Previously, the OSDC (Kubernetes pod) build job could not upload docs previews to S3 for pull requests originating from forks. This was because fork PRs cannot authenticate via OIDC from the build job, and granting the pod's IAM role S3 write access on `doc-previews/` was avoided for security. The result was that external contributors' docs previews silently failed to publish.
The fix, implemented in PR #184414 by Claude, restructures the pipeline. The `build-docs-osdc` job now stages the built documentation as a GitHub Actions artifact (`docs-preview-osdc-<docs_type>`) along with PR metadata. A new `upload-docs-preview` workflow, triggered by `workflow_run` upon completion of the `pull` workflow, runs in the base-repo context (full OIDC + secrets), downloads the staged artifact, and performs an `aws s3 sync` to the appropriate preview bucket. This design works for fork PRs because the uploader runs with the base repository's credentials, not the fork's. The change also gates C++ docs coverage comments on same-repo PRs to avoid spurious failures from the read-only `GITHUB_TOKEN`. Follow-ups include updating the AWS trust policy and optionally removing S3 write permissions from the OSDC pod. The result is a smoother contributor experience with reliable preview URLs for all pull requests.
- Moves S3 upload from OSDC build pod to a `workflow_run` job running in base-repo context, fixing fork PR authentication
- Stages built docs as GHA artifacts (docs-preview-osdc-python/cpp) with PR metadata before upload
- C++ coverage comments now skip on fork PRs instead of failing due to read-only GITHUB_TOKEN
Why It Matters
Ensures external contributors to PyTorch get reliable documentation previews, improving collaboration and code review efficiency.