[DO NOT MERGE] fix: safer two workflow filecoin upload

.github/workflows/filecoin-pin-build.yml

@@ -0,0 +1,34 @@
+name: Build Site
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  actions: write  # needed to upload artifacts
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build site
+        run: npm run build
+
+      - name: Create CAR file and save metadata
+        uses: sgtpooki/filecoin-upload-action@641a2bf866d4ad0c47c98c0ddefaffdd4e628500
+        with:
+          path: public

.github/workflows/filecoin-pin-upload.yml

@@ -1,43 +1,42 @@
-name: Upload site to Filecoin
+name: Upload to Filecoin
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-  workflow_dispatch:
+  workflow_run:
+    workflows: ["Build Site"]
+    types: [completed]
+  workflow_dispatch:  # Allow manual triggers
+    inputs:
+      artifact_name:
+        description: 'Artifact name (for manual testing only, e.g., filecoin-build-pr-822)'
+        required: false
+        type: string
+      build_run_id:
+        description: 'Build workflow run ID (find it in the build workflow URL)'
+        required: false
+        type: string
 
 permissions:
   contents: read
-  actions: read
-  pull-requests: write
+  actions: read        # needed to download artifacts
+  pull-requests: write # needed to comment on PRs
 
 jobs:
   upload:
+    # Only upload if build succeeded
+    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
     env:
       GITHUB_TOKEN: ${{ secrets.FILECOIN_PIN_GH_TOKEN }}
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }}
-    runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20.x
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build site
-        run: npm run build
-
       - name: Upload to Filecoin
-        uses: sgtpooki/filecoin-upload-action@main
+        uses: sgtpooki/filecoin-upload-action@641a2bf866d4ad0c47c98c0ddefaffdd4e628500
         with:
-          privateKey: ${{ secrets.FILECOIN_WALLET_KEY }}
-          path: public
-          minDays: 30
-          maxTopUp: ${{ github.event_name == 'pull_request' && '0.0001' || '0.01' }}
+          mode: upload
+          artifact_name: ${{ inputs.artifact_name }} # only used if manually input from the action trigger UI
+          build_run_id: ${{ inputs.build_run_id }} # only used if manually input from the action trigger UI
+          walletPrivateKey: ${{ secrets.FILECOIN_WALLET_KEY }}
+          minDays: "30"
+          # 0.0001 USDFC for PRs, 0.10 USDFC for main
+          maxTopUp: ${{ github.event.workflow_run.event == 'pull_request' && '0.0001' || '0.01' }}
+          # Note: this provider should not be set in prod, but while testing things, it's a reliable provider we can depend on.
           providerAddress: "0xa3971A7234a3379A1813d9867B531e7EeB20ae07"