ci: fix pr-preview-action pr check failures (#1091)

Author: evansims

.github/workflows/preview.yml

@@ -1,7 +1,7 @@
 # .github/workflows/preview.yml
 name: Deploy PR previews
 permissions:
-  contents: write
+  contents: read
 concurrency:
   group: preview-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -16,7 +16,13 @@ on:
 jobs:
   deploy-preview:
     runs-on: ubuntu-latest
-    if: github.actor != 'dependabot[bot]'
+    if: |
+      github.actor != 'dependabot[bot]' &&
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: write # Required for pr-preview-action to push to gh-pages
+      pull-requests: write # Required for PR comments
     steps:
       - name: Cached LFS checkout
         uses: nschloe/action-cached-lfs-checkout@f46300cd8952454b9f0a21a3d133d4bd5684cfc2
@@ -38,5 +44,13 @@ jobs:
 
       - name: Deploy preview
         uses: rossjrw/pr-preview-action@9f77b1d057b494e662c50b8ca40ecc63f21e0887
+        id: preview-step
         with:
           source-dir: ./build/
+
+      - name: Publish preview link to job summary
+        if: steps['preview-step'].outputs['deployment-action'] == 'deploy'
+        run: |
+          url="${{ steps['preview-step'].outputs['preview-url'] }}"
+          echo "Preview visible at ${url}" >> "$GITHUB_STEP_SUMMARY"
+          echo "[Open preview](${url})" >> "$GITHUB_STEP_SUMMARY"