Harden Storybook PR preview workflow and patch vulnerable artifact download action

[Copilot]

This PR addresses the workflow security review feedback by separating untrusted PR build execution from privileged deployment, and patches the vulnerable actions/download-artifact version used in the deploy path.

• Workflow trust boundary split

  • Converted PR preview build to run on pull_request with read-only token scope.
  • Moved privileged preview publish/remove operations into a separate trusted workflow triggered by workflow_run (deploy) and pull_request_target (close cleanup).

• Permission minimization

  • Build job no longer holds write-scoped permissions.
  • Deploy/remove jobs retain contents: write / pull-requests: write only where required.

• Safe artifact-based deploy flow

  • Build workflow uploads storybook-static as an artifact.
  • Deploy workflow downloads artifact from the completed build run and publishes preview for the resolved PR number.
  • Added guard logic for workflow_run events with no associated PR payload.

• Vulnerability remediation

  • Updated actions/download-artifact from @v4 to @v4.1.3 in deploy workflow to avoid the arbitrary file write vulnerability affecting <4.1.3.

- name: Download Storybook artifact
  uses: actions/download-artifact@v4.1.3
  with:
    name: storybook-static
    path: storybook-static
    github-token: ${{ secrets.GITHUB_TOKEN }}
    run-id: ${{ github.event.workflow_run.id }}

[Copilot]

Pull request overview

This PR hardens the Storybook PR preview pipeline by splitting untrusted PR build execution from privileged deploy/cleanup operations, and updates the deploy path to use a patched actions/download-artifact version.

Changes:

• Added a pull_request workflow to build Storybook and upload storybook-static as an artifact with read-only token scope.
• Added a trusted deploy/cleanup workflow triggered by workflow_run (deploy) and pull_request_target (close cleanup) with scoped write permissions.
• Patched the deploy workflow to use actions/download-artifact@v4.1.3.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
.github/workflows/storybook-preview.yml	New PR build workflow that uploads the Storybook static output as an artifact.
.github/workflows/storybook-preview-deploy.yml	New trusted deploy/cleanup workflow that downloads artifacts from the build run and publishes/removes PR previews.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.