Skip to content

Move sandboxed preview to quarto-dev.github.io/q2-sandbox (bd-73lilznv) - #919

Merged
cscheid merged 3 commits into
mainfrom
feature/bd-73lilznv-move-sandboxed-preview-quarto
Oct 26, 2026
Merged

cscheid merged 3 commits into
mainfrom
feature/bd-73lilznv-move-sandboxed-preview-quarto

Conversation

@cscheid

@cscheid cscheid commented Oct 26, 2026

Copy link
Copy Markdown
Member

Why

Today https://quarto-dev.github.io/q2/ serves the q2-sandboxed-preview iframe. We want that URL for the Q2 documentation. This PR moves the sandbox to https://quarto-dev.github.io/q2-sandbox/ and leaves the old deploy running until production switches over.

Plan: claude-notes/plans/2026-10-26-move-sandbox-free-q2-pages.md (strand bd-73lilznv).

What

  • New workflow deploy-q2-sandbox.yml. A workflow can't deploy Pages for another repo, so this one builds the sandbox bundle here and force-pushes it as a single commit to the gh-pages branch of the new quarto-dev/q2-sandbox repo. It uses plain git with a deploy key that has write access to q2-sandbox only, stored as the Q2_SANDBOX_DEPLOY_KEY secret. There is no third-party action.
  • hub-client default VITE_Q2_SANDBOXED_PREVIEW_URL → https://quarto-dev.github.io/q2-sandbox/. The origin is unchanged, so the pinned postMessage target origin stays the same.
  • Tests: assetPolicy.test.ts uses the new scope. A new test checks that /q2/ (the docs) is outside the sandbox's scope even though /q2 is a string prefix of /q2-sandbox.
  • Docs: github-pages.md, the separate-origin design doc, the snyk KaTeX reference, and the hub-client changelog.
  • deploy-sandboxed-preview.yml is marked transitional and still deploys to /q2/. The quarto-hub.com build in production still points there until it is rebuilt.

Already done outside this PR

  • Created quarto-dev/q2-sandbox, its deploy key, and the secret on this repo.
  • Seeded gh-pages by hand from a local build and turned on Pages. https://quarto-dev.github.io/q2-sandbox/ is live. The page, serviceWorker.js, the JS/CSS chunks and the KaTeX fonts all return 200 with the right content types.

Testing

  • hub-client npm run test: 1686/1686 passed. npm run test:wasm: 434 passed, 28 skipped. tsc -b is clean.
  • actionlint passes on both workflows.
  • deploy-q2-sandbox.yml only triggers on pushes to main, so CI on this PR doesn't exercise it. Its first run is on merge, and I'll check that it succeeds.

After merge (separate steps)

  1. Rebuild quarto-hub.com from quarto-hub-deployment and check that the live bundle references /q2-sandbox/.
  2. Delete deploy-sandboxed-preview.yml and add the docs deploy to /q2/. That deploy will include a self-unregistering serviceWorker.js so stale sandbox service workers at scope /q2/ can't return 502s on docs pages.

Out of scope: giving the sandbox an origin of its own instead of sharing quarto-dev.github.io (bd-gotwa715).

🤖 Generated with Claude Code

cscheid and others added 2 commits October 26, 2026 15:12
…-73lilznv)

quarto-dev.github.io/q2 is being freed for the Q2 documentation. The
sandboxed preview iframe now defaults to
https://quarto-dev.github.io/q2-sandbox/, served from the gh-pages branch
of the new quarto-dev/q2-sandbox repo. deploy-q2-sandbox.yml builds the
bundle here and force-pushes it there with a deploy key scoped to that
repo (secret Q2_SANDBOX_DEPLOY_KEY).

deploy-sandboxed-preview.yml keeps publishing to /q2/ until production
quarto-hub.com is rebuilt against the new default; it is then deleted.

Plan: claude-notes/plans/2026-10-26-move-sandbox-free-q2-pages.md

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…lznv)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@posit-snyk-bot

posit-snyk-bot commented Oct 26, 2026 •

Copy link
Copy Markdown
Contributor

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

The fenced code block inside a list item needs blank lines around it and
must sit at the item's content column, and '~2027' is an unclosed
subscript. Caught by the strict claude-notes render in CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cscheid
cscheid merged commit d1522ac into main Oct 26, 2026
15 checks passed
@cscheid
cscheid deleted the feature/bd-73lilznv-move-sandboxed-preview-quarto branch October 26, 2026 21:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants