fix: varlock/auto-load CLI resolution in serverless bundles#733
fix: varlock/auto-load CLI resolution in serverless bundles#733RobAndrewHurst wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR improves varlock/auto-load reliability in serverless/Vercel-style bundles by adding a fallback execution path that can run the Varlock CLI directly from the installed package files when node_modules/.bin/varlock is missing.
Changes:
- Adds a package-local CLI resolution fallback to
execSyncVarlock(after PATH andnode_modules/.binlookup). - Ensures
execSyncVarlock-specific options are stripped before passing options intoexecSync/execFileSync. - Adds a regression test covering the “missing
.bin” layout and includes a patch bump via bumpy.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| packages/varlock/src/lib/test/exec-sync-varlock.test.ts | Adds a regression test verifying the new package-local CLI fallback behavior. |
| packages/varlock/src/lib/exec-sync-varlock.ts | Implements the new resolution fallback to a package-local CLI entry and refactors option handling/result formatting. |
| .bumpy/vercel-package-cli-fallback.md | Patch bump entry describing the serverless CLI resolution fix. |
| const isWindows = platform.match(/^win/i); | ||
| const moduleDir = import.meta.dirname ?? path.dirname(fileURLToPath(import.meta.url)); | ||
| // Keep this URL static so serverless file tracers include the CLI entry. | ||
| const tracedPackageCliPath = fileURLToPath(new URL('./cli/cli-executable.js', import.meta.url)); |
|
@RobAndrewHurst - thanks for this! Can you clarify with some more context around your application? I understand you are running on vercel, but likely not nextjs, and maybe not vite either? Is it just raw vercel functions? Some other framework? In general this seems like a good fallback, but I do want to flag something - in your situation this would potentially mean it would run varlock on each serverless invocation. If so that could introduce a lot of latency - not necessarily if it's just validation, but if it's loading anything external. So far the idea with these kinds of environments is that we resolve everything at build time, but this requires injecting some additional code, which usually happens in our framework integrations. |
|
For context, the application is a good old home-cooked vanilla JavaScript app, with no framework of any kind. In the next major release, we’re planning to move toward Express for the backend. You’re correct that each invocation would result in a call to Varlock and the secret manager. I’ve added a handler so that each request will create an OIDC token only if one isn’t currently available. |
|
gotcha - yeah I think you probably want to resolve and validate the config, and freeze it at build/deploy time, so that it's not running on each serverless invocation. You'd need to add some kind of build tooling - probably vite with our vite plugin to your stack to do this. This would inject the varlock init code for you, as well as the resolved env blob. Could also do something a little more manual with tsup (or tsdown). I have a PR up (should be merged soon) that would also encrypt that injected blob using a secret set in vercel's secrets system. |
What's the Craic? 🍀
This PR fixes
varlock/auto-loadin Vercel/serverless environments wherenode_modules/varlock/distis present butnode_modules/.bin/varlockis not included in the traced function bundle.Changes
execSyncVarlock.node_modules/.bin, then package-local CLI.new URL('./cli/cli-executable.js', import.meta.url)reference so serverless file tracers can include the CLI entry.execSyncVarlock-only options before passing options toexecSyncandexecFileSync..binlayout.varlock.Why
Vercel serverless functions can trace
node_modules/varlock/distwithout includingnode_modules/.bin/varlock. Previously, that causedvarlock/auto-loadto fail during module initialization before the function handler ran.Running the package-local CLI entry avoids depending on
.binwhile preserving existing behavior for normal local and package-manager execution.Validation
bun run test src/lib/test/exec-sync-varlock.test.tsbun run lint:fixbun run --filter varlock pack:local