René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Replace deprecated `readthedocs/actions/preview`","articleBody":"As I was reviewing the `python/cpython` workflows for security issues, I noticed that [`documentation-links.yml`](https://github.com/python/cpython/blob/main/.github/workflows/documentation-links.yml#L6) uses `pull_request_target`, which is potentially dangerous:\n* https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/\n* https://github.com/readthedocs/actions/issues/45\n\nThis is apparently required by `readthedocs/actions/preview` in order to edit the first PR message and add the link to the doc preview.\n\nHowever I also noticed that [`readthedocs/actions/preview`](https://github.com/readthedocs/actions?tab=readme-ov-file) is now deprecated and that its README states:\n\n\u003e [!WARNING]  \n\u003e **This action is deprecated and it shouldn't be used.**\n\u003e This feature was included in the Read the Docs application itself.\n\u003e For more information, check [our documentation](https://docs.readthedocs.com/platform/stable/visual-diff.html#show-build-overview-in-pull-requests).\n\nAs an alternative they suggest to connect their GitHub app and use that instead.  Instead of editing the first comment, the app will add a comment which will list and link to changed/added/deleted files.\nNote that [the app](https://about.readthedocs.com/blog/2025/06/announcing-our-github-app-beta/) is still in beta.\n\nIf we switch to the app we can stop using the deprecated action get rid of the `documentation-links.yml` workflow and `pull_request_target` use.\n\nI brought this up to @hugovk attention, and he suggested to try the app on one of the other (smaller) repos first:\n* [ ] [`devguide`](https://github.com/python/devguide/blob/main/.github/workflows/documentation-links.yml): [devguide#1713](https://github.com/python/devguide/pull/1713)\n* [ ] [`peps`](https://github.com/python/peps/blob/1b13e95ea8713f0d90b020e1a7ba4e65de735e06/.github/workflows/documentation-links.yml#L21)\n* [ ] [`python-docs-theme`](https://github.com/python/python-docs-theme/blob/ae83e69a9ce370c9f7f4c27bd37ad5e6536fea76/.github/workflows/documentation-links.yml#L21)\n* [ ] [`docs-community`](https://github.com/python/docs-community/blob/b9aa7830fdc1ea2c29c1f335ec6face1791a1d2e/.github/workflows/documentation-links.yml#L15)\n\nIf it works fine and we are happy with it, we can then update all the other repos (including `cpython`).\n\n* [ ] `cpython`\n\ncc @humitos","author":{"url":"https://github.com/ezio-melotti","@type":"Person","name":"ezio-melotti"},"datePublished":"2025-11-10T12:53:30.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/587/core-workflow/issues/587"}