[ci] Authorize preview tarball uploads with GitHub OIDC tokens - #97256
Open
eps1lon wants to merge 3 commits into
Open
[ci] Authorize preview tarball uploads with GitHub OIDC tokens#97256eps1lon wants to merge 3 commits into
eps1lon wants to merge 3 commits into
Conversation
The upload workflow no longer uses the PREVIEW_BUILDS_BLOB_READ_WRITE_TOKEN secret. The job mints GitHub Actions OIDC tokens itself (the workflow gains id-token: write) and exchanges them at vercel-packages for scoped client-upload tokens via POST, then uploads the tarball bytes directly to Blob storage with @vercel/blob/client's put. The token getter re-mints shortly before expiry since a token lives about five minutes while a package batch can take longer. The preview-builds environment stays on the job so the mirror's approval gate keeps working. Co-Authored-By: Claude Code (kimi-k3[1m]) <noreply@anthropic.com>
Contributor
Stats from current PR🔴 2 regressions
📊 All Metrics📖 Metrics GlossaryDev Server Metrics:
Build Metrics:
Change Thresholds:
⚡ Dev Server
📦 Dev Server (Webpack) (Legacy)📦 Dev Server (Webpack)
⚡ Production Builds
📦 Production Builds (Webpack) (Legacy)📦 Production Builds (Webpack)
📦 Bundle SizesBundle Sizes⚡ TurbopackClient Main Bundles
Server Middleware
Build DetailsBuild Manifests
Build Cache
📦 WebpackClient Main Bundles
Polyfills
Pages
Server Edge SSR
Middleware
Build DetailsBuild Manifests
Build Cache
🔄 Shared (bundler-independent)Runtimes
📎 Tarball URLCommit: d5fd5b7 |
Contributor
Failing test suitesCommit: d5fd5b7 | About building and testing Next.js
Expand output● experimental-https-server OpenGraph image › should generate https:// URLs for OpenGraph images when experimental HTTPS is enabled Other failing CI jobs
|
eps1lon
changed the title
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
The blob client rejects addRandomSuffix on uploads authorized by a client token since the option belongs to token generation. Verified locally with a full upload roundtrip against the staging store. Co-Authored-By: Claude Code (kimi-k3[1m]) <noreply@anthropic.com>
eps1lon
changed the title
eps1lon
marked this pull request as ready for review
August 12, 2026 18:57
The environment only existed to selectively expose the static blob token and to restrict uploads to canary. With uploads authorized by OIDC claims, the canary-only restriction is enforced by matching the full job_workflow_ref including the canary ref at vercel-packages, so the environment is no longer needed. Co-Authored-By: Claude Code (kimi-k3[1m]) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the static
PREVIEW_BUILDS_BLOB_READ_WRITE_TOKENsecret with GitHub OIDC tokens for uploading preview builds (endpoint side: https://github.com/vercel/vercel-packages/pull/98):https://vercel-packages.vercel.appaudience itself (the workflow gainsid-token: write) and re-mints shortly before expiry since a token lives about five minutes while a package batch can take longerupload-preview-tarballs.jsexchanges the token at vercel-packages for scoped client-upload tokens via POST and uploads the tarball bytes directly to Blob storage with@vercel/blob/client'sput, so the blob read-write token never leaves vercel-packagespreview-buildsenvironment is dropped from the job: it only existed to selectively expose the static token and restrict uploads to canary, and the canary binding is now enforced by thejob_workflow_refmatch at vercel-packages. Note this also removes the mirror's approval gate on uploads (that rule lives on the environment)Test plan
upload-preview-tarballsruns here and in the mirror🤖 Generated with Claude Code