Fix pull request preview deployment workflow #1179
Conversation
…gration Co-authored-by: martin.donadieu <[email protected]>
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Set Supabase credentials | ||
| run: | | ||
| echo "SUPABASE_DB_PASSWORD=${{ secrets[format('SUPABASE_DB_PASS_{0}', env.SUPA_ENV)] }}" >> $GITHUB_ENV |
Check warning
Code scanning / CodeQL
Excessive Secrets Exposure Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 20 days ago
To fix the problem, we need to avoid dynamic secret access and instead reference secrets statically. Since the workflow currently uses env.SUPA_ENV (set to "PROD") to determine which secret to use, we can directly reference the production secrets. Specifically, replace:
echo "SUPABASE_DB_PASSWORD=${{ secrets[format('SUPABASE_DB_PASS_{0}', env.SUPA_ENV)] }}" >> $GITHUB_ENV
echo "SUPABASE_PROJECT_ID=${{ secrets[format('SUPABASE_PROJECT_ID_{0}', env.SUPA_ENV)] }}" >> $GITHUB_ENVwith:
echo "SUPABASE_DB_PASSWORD=${{ secrets.SUPABASE_DB_PASS_PROD }}" >> $GITHUB_ENV
echo "SUPABASE_PROJECT_ID=${{ secrets.SUPABASE_PROJECT_ID_PROD }}" >> $GITHUB_ENVThis change should be made in .github/workflows/preview_deploy.yml, lines 33 and 34. No new imports or methods are needed, just a direct edit to the workflow YAML.
| @@ -32,4 +32,4 @@ | ||
| run: | | ||
| echo "SUPABASE_DB_PASSWORD=${{ secrets[format('SUPABASE_DB_PASS_{0}', env.SUPA_ENV)] }}" >> $GITHUB_ENV | ||
| echo "SUPABASE_PROJECT_ID=${{ secrets[format('SUPABASE_PROJECT_ID_{0}', env.SUPA_ENV)] }}" >> $GITHUB_ENV | ||
| echo "SUPABASE_DB_PASSWORD=${{ secrets.SUPABASE_DB_PASS_PROD }}" >> $GITHUB_ENV | ||
| echo "SUPABASE_PROJECT_ID=${{ secrets.SUPABASE_PROJECT_ID_PROD }}" >> $GITHUB_ENV | ||
| - name: Install dependencies |
| - name: Set Supabase credentials | ||
| run: | | ||
| echo "SUPABASE_DB_PASSWORD=${{ secrets[format('SUPABASE_DB_PASS_{0}', env.SUPA_ENV)] }}" >> $GITHUB_ENV | ||
| echo "SUPABASE_PROJECT_ID=${{ secrets[format('SUPABASE_PROJECT_ID_{0}', env.SUPA_ENV)] }}" >> $GITHUB_ENV |
Check warning
Code scanning / CodeQL
Excessive Secrets Exposure Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 20 days ago
To fix the problem, we need to avoid dynamic secret access and instead reference each required secret explicitly. Since SUPA_ENV is set to PROD in the workflow, only the production secrets are ever used. Therefore, we can replace the dynamic secret access with direct references to secrets.SUPABASE_DB_PASS_PROD and secrets.SUPABASE_PROJECT_ID_PROD. This change should be made in the step "Set Supabase credentials" (lines 31–34). No other changes are needed, as the rest of the workflow already uses explicit secret references.
| @@ -32,4 +32,4 @@ | ||
| run: | | ||
| echo "SUPABASE_DB_PASSWORD=${{ secrets[format('SUPABASE_DB_PASS_{0}', env.SUPA_ENV)] }}" >> $GITHUB_ENV | ||
| echo "SUPABASE_PROJECT_ID=${{ secrets[format('SUPABASE_PROJECT_ID_{0}', env.SUPA_ENV)] }}" >> $GITHUB_ENV | ||
| echo "SUPABASE_DB_PASSWORD=${{ secrets.SUPABASE_DB_PASS_PROD }}" >> $GITHUB_ENV | ||
| echo "SUPABASE_PROJECT_ID=${{ secrets.SUPABASE_PROJECT_ID_PROD }}" >> $GITHUB_ENV | ||
| - name: Install dependencies |
| needs: supabase_deploy | ||
| runs-on: ubuntu-latest | ||
| name: Deploy Frontend Preview | ||
| outputs: | ||
| preview_url: ${{ steps.deploy_frontend.outputs.url }} | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - name: Setup bun | ||
| uses: oven-sh/setup-bun@v2 | ||
| with: | ||
| bun-version: latest | ||
| - name: Install dependencies | ||
| run: bun install | ||
| - name: Set preview environment variables | ||
| run: | | ||
| echo "PREVIEW_NAME=capgo-preview-${{ env.PR_NUMBER }}" >> $GITHUB_ENV | ||
| echo "PREVIEW_DOMAIN=capgo-preview-${{ env.PR_NUMBER }}.pages.dev" >> $GITHUB_ENV | ||
| echo "API_PREVIEW_NAME=capgo-api-preview-${{ env.PR_NUMBER }}" >> $GITHUB_ENV | ||
| echo "FILES_PREVIEW_NAME=capgo-files-preview-${{ env.PR_NUMBER }}" >> $GITHUB_ENV | ||
| echo "PLUGIN_PREVIEW_NAME=capgo-plugin-preview-${{ env.PR_NUMBER }}" >> $GITHUB_ENV | ||
|
|
||
| - name: Build frontend (production build) | ||
| run: bun mobile | ||
| env: | ||
| VITE_VAPID_KEY: ${{ secrets.VITE_VAPID_KEY }} | ||
| VITE_FIREBASE_CONFIG: ${{ secrets.VITE_FIREBASE_CONFIG }} | ||
|
|
||
| - name: Deploy frontend to Cloudflare Pages | ||
| id: deploy_frontend | ||
| run: | | ||
| # Deploy to a preview project using production build | ||
| bunx wrangler@latest pages deploy dist \ | ||
| --project-name ${{ env.PREVIEW_NAME }} \ | ||
| --branch preview-${{ env.PR_NUMBER }} \ | ||
| --commit-dirty=true | ||
|
|
||
| # Set the preview URL as output | ||
| echo "url=https://${{ env.PREVIEW_DOMAIN }}" >> $GITHUB_OUTPUT | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
|
|
||
| - name: Deploy API Worker (production config) | ||
| deploy_api: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 20 days ago
To fix the problem, add a permissions block to the workflow file .github/workflows/preview_deploy.yml. This block should be placed at the top level (after the name: and before concurrency: or on:) to apply to all jobs unless overridden. The minimal starting point is contents: read, which allows jobs to check out code but not modify repository contents. If any job requires additional permissions (e.g., to create issues or pull requests), those can be added as needed, but for the jobs shown, contents: read is sufficient.
| @@ -1,2 +1,4 @@ | ||
| name: Deploy Preview Environment | ||
| permissions: | ||
| contents: read | ||
|
|
| needs: supabase_deploy | ||
| runs-on: ubuntu-latest | ||
| name: Deploy API Worker Preview | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - name: Setup bun | ||
| uses: oven-sh/setup-bun@v2 | ||
| with: | ||
| bun-version: latest | ||
| - name: Install dependencies | ||
| run: bun install | ||
| - name: Set preview environment variables | ||
| run: | | ||
| # Create preview config from production config | ||
| jq '.name = "${{ env.API_PREVIEW_NAME }}" | .workers_dev = true | del(.route) | del(.routes)' \ | ||
| cloudflare_workers/api/wrangler.json > /tmp/wrangler-api-preview.json | ||
|
|
||
| bunx wrangler deploy --config /tmp/wrangler-api-preview.json --minify | ||
| echo "API_PREVIEW_NAME=capgo-api-preview-${{ env.PR_NUMBER }}" >> $GITHUB_ENV | ||
| - name: Create preview API worker config | ||
| run: | | ||
| # Create a temporary wrangler config for preview with production bindings | ||
| cat cloudflare_workers/api/wrangler.json | \ | ||
| jq --arg name "${{ env.API_PREVIEW_NAME }}" \ | ||
| '.name = $name | .workers_dev = true | del(.route) | del(.routes)' \ | ||
| > /tmp/wrangler-api-preview.json | ||
| - name: Deploy API Worker (with production config) | ||
| run: bunx wrangler deploy --config /tmp/wrangler-api-preview.json --minify | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
| - name: Deploy API Worker environment variables | ||
| run: node scripts/deploy_cf_backend_env.mjs internal/cloudflare/.env.prod ${{ env.API_PREVIEW_NAME }} | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
|
|
||
| - name: Deploy Files Worker (production config) | ||
| deploy_files: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 20 days ago
To fix the problem, add a permissions block to the root of the workflow file (.github/workflows/preview_deploy.yml). This will set the default permissions for all jobs in the workflow, limiting the GITHUB_TOKEN to only the specified scopes. The recommended minimal starting point is contents: read, which allows jobs to read repository contents but not write to them. If any job requires additional permissions (e.g., to comment on pull requests), those can be added at the job level. The change should be made at the top of the workflow file, after the name: declaration and before the concurrency: or on: blocks.
| @@ -1,2 +1,4 @@ | ||
| name: Deploy Preview Environment | ||
| permissions: | ||
| contents: read | ||
|
|
| needs: supabase_deploy | ||
| runs-on: ubuntu-latest | ||
| name: Deploy Files Worker Preview | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - name: Setup bun | ||
| uses: oven-sh/setup-bun@v2 | ||
| with: | ||
| bun-version: latest | ||
| - name: Install dependencies | ||
| run: bun install | ||
| - name: Set preview environment variables | ||
| run: | | ||
| echo "FILES_PREVIEW_NAME=capgo-files-preview-${{ env.PR_NUMBER }}" >> $GITHUB_ENV | ||
| - name: Create preview Files worker config | ||
| run: | | ||
| # Create preview config from production config | ||
| jq '.name = "${{ env.FILES_PREVIEW_NAME }}" | .workers_dev = true | del(.route) | del(.routes)' \ | ||
| cloudflare_workers/files/wrangler.json > /tmp/wrangler-files-preview.json | ||
|
|
||
| bunx wrangler deploy --config /tmp/wrangler-files-preview.json --minify | ||
| # Create a temporary wrangler config for preview with production bindings | ||
| cat cloudflare_workers/files/wrangler.json | \ | ||
| jq --arg name "${{ env.FILES_PREVIEW_NAME }}" \ | ||
| '.name = $name | .workers_dev = true | del(.routes)' \ | ||
| > /tmp/wrangler-files-preview.json | ||
| - name: Deploy Files Worker (with production config) | ||
| run: bunx wrangler deploy --config /tmp/wrangler-files-preview.json --minify | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
| - name: Deploy Files Worker environment variables | ||
| run: node scripts/deploy_cf_backend_env.mjs internal/cloudflare/.env.prod ${{ env.FILES_PREVIEW_NAME }} | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
|
|
||
| - name: Deploy Plugin Worker (production config) | ||
| deploy_plugin: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 20 days ago
To fix the problem, add a permissions block at the top level of the workflow file, immediately after the name: field and before any jobs or steps. This block should specify the minimal permissions required for the workflow to function. As a safe default, set contents: read, which allows the workflow to read repository contents but not write to them. If any job requires additional permissions (such as pull-requests: write), those can be added at the job level, but based on the provided code, contents: read is sufficient. The change should be made at the top of .github/workflows/preview_deploy.yml, after the name: field and before concurrency:.
| @@ -1,2 +1,4 @@ | ||
| name: Deploy Preview Environment | ||
| permissions: | ||
| contents: read | ||
|
|
| needs: supabase_deploy | ||
| runs-on: ubuntu-latest | ||
| name: Deploy Plugin Worker Preview | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - name: Setup bun | ||
| uses: oven-sh/setup-bun@v2 | ||
| with: | ||
| bun-version: latest | ||
| - name: Install dependencies | ||
| run: bun install | ||
| - name: Set preview environment variables | ||
| run: | | ||
| echo "PLUGIN_PREVIEW_NAME=capgo-plugin-preview-${{ env.PR_NUMBER }}" >> $GITHUB_ENV | ||
| - name: Create preview Plugin worker config | ||
| run: | | ||
| # Create preview config from production config | ||
| jq '.name = "${{ env.PLUGIN_PREVIEW_NAME }}" | .workers_dev = true | del(.route) | del(.routes)' \ | ||
| cloudflare_workers/plugin/wrangler.json > /tmp/wrangler-plugin-preview.json | ||
|
|
||
| bunx wrangler deploy --config /tmp/wrangler-plugin-preview.json --minify | ||
| # Create a temporary wrangler config for preview with production bindings | ||
| cat cloudflare_workers/plugin/wrangler.json | \ | ||
| jq --arg name "${{ env.PLUGIN_PREVIEW_NAME }}" \ | ||
| '.name = $name | .workers_dev = true | del(.routes)' \ | ||
| > /tmp/wrangler-plugin-preview.json | ||
| - name: Deploy Plugin Worker (with production config) | ||
| run: bunx wrangler deploy --config /tmp/wrangler-plugin-preview.json --minify | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
| - name: Deploy Plugin Worker environment variables | ||
| run: node scripts/deploy_cf_backend_env.mjs internal/cloudflare/.env.prod ${{ env.PLUGIN_PREVIEW_NAME }} | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
|
|
||
| comment_pr: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 20 days ago
To fix the problem, add a permissions block at the top level of the workflow file, specifying the minimal permissions required for all jobs. If some jobs require additional permissions, you can override the permissions block at the job level. For this workflow:
- Most jobs likely only need
contents: read(to check out code). - The
comment_prjob needspull-requests: writeto comment on PRs. - If any other jobs require more permissions, they can be specified as needed.
The best fix is to add the following at the top of the workflow (after name: and before concurrency:):
permissions:
contents: readThen, for the comment_pr job, add a permissions block to allow writing to pull requests:
permissions:
contents: read
pull-requests: writeNo new imports or definitions are needed; only YAML changes.
| @@ -2,2 +2,5 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| concurrency: | ||
| @@ -195,2 +198,5 @@ | ||
| name: Comment PR with preview URLs | ||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| steps: |
|
Summary
This PR overhauls the preview deployment workflow to accurately mirror the production deployment process. The goal is to provide a reliable, production-like testing environment for every pull request. This includes deploying Supabase functions, the frontend, and all Cloudflare Workers (API, Files, Plugin) with their respective production configurations and bindings, but using the PR's code. Upon successful deployment, direct links to all preview environments are now posted as a comment on the pull request.
Test plan
preview_deploy.yml.supabase_deploy,deploy_webapp,deploy_api,deploy_files,deploy_plugin,comment_pr) complete successfully.preview_cleanupworkflow runs and removes the deployed preview resources.Screenshots
N/A
Checklist
bun run lint-backend && bun run lint.Learn more about Cursor Agents