Repository navigation
ci(vercel-preview-guard): accept current Vercel env/context names - #3531
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: f3b41208-ed67-49a6-aab3-595d5e55f7b0) |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes.
 |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check |  |
The description states the problem and the change. Vercel now reports PR deployments with environment Preview and commit status Vercel. The guard now accepts either naming, and the hostname allowlist … | Add the template sections that are missing: tick the applicable Type of Change option (CI/CD or infrastructure fits this change); state the Test Plan and tick the matching option (for example, Manual testing performed, if the author checked… |
-
Check name Status Explanation Title check The title names the change: the Vercel preview guard workflow now accepts the current Vercel environment and context names. It matches the raw summary, which says the guard accepts both project-specif… Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title names the change: the Vercel preview guard workflow now accepts the current Vercel environment and context names. It matches the raw summary, which says the guard accepts both project-specific and generic environment and status names. The title uses the ci scope and is short, specific, and readable.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Full details: Description check
-
Explanation
The description states the problem and the change. Vercel now reports PR deployments with environment Preview and commit status Vercel. The guard now accepts either naming, and the hostname allowlist and rejection logic stay unchanged. It includes a concrete example (PR
#3524, run 39969090298) and notes that the check is not required. It does not fill in the template's Type of Change, Test Plan, Checklist, or Related Issues sections. Those sections are missing, so the description only partly follows the template.Resolution
Add the template sections that are missing: tick the applicable Type of Change option (CI/CD or infrastructure fits this change); state the Test Plan and tick the matching option (for example, Manual testing performed, if the author checked the guard against PR
#3524or a new preview); complete the Checklist items; and fill in Related Issues, or write N/A if no issue applies. Keep the Summary section as is. The description is a good base, but it needs these sections to match the required template.
✨ Finishing Touches: 💡 1
-
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
PR Blocker ChecklistHead SHA: Status: Blocked (1 open blocker)Review Threads (1 unresolved)
Changes Requested (0)
Blocked Engines (0)
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4364db5d10
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| while (Date.now() < deadline) { | ||
| const { data: deployments } = await github.rest.repos.listDeployments({ | ||
| owner, repo, sha, environment, per_page: 100, | ||
| owner, repo, sha, per_page: 100, |
There was a problem hiding this comment.
When another project or integration creates a Preview deployment for the same SHA, removing the server-side environment filter lets that deployment appear in this result set, but the subsequent .find(...) selects only one candidate. If that candidate's URL fails the regengine hostname allowlist, the loop repeatedly inspects it and never examines a later valid regengine deployment, so this non-required guard waits 25 minutes and never posts the access link. Iterate through all matching deployments until the URL identifies the regengine project (or query each accepted environment separately) rather than validating only the first match.
Useful? React with 👍 / 👎.
Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com>
PetrefiedThunder
left a comment
PetrefiedThunder
left a comment
There was a problem hiding this comment.
REVIEW: PASS grok 5d3a4c8
Full review (no earlier grok marker). Diff vs main 658bc7f: .github/workflows/vercel-preview-guard.yml only.
- Change: accept environment names [Preview – regengine, Preview] and status/check contexts [Vercel – regengine, Vercel]; the environment filter moves from the listDeployments query to the client-side find (sha match kept, newest deployment first, per_page 100).
- Security: trigger is pull_request (not pull_request_target); job permissions are read-only (deployments, statuses, checks); actions/github-script pinned by full SHA (3a2844b7, v9); the head SHA reaches the script via env (HEAD_SHA), not expression interpolation, so no script injection.
- actionlint: clean.
- Nit: the plain Preview/Vercel names are broader; if a second Vercel project ever deploys the same SHA, the guard could pick that project's deployment. Fine for the current single-project setup.
- CI: required gates still running at review time; PR Blocker Checklist failing pending an engine review.
Posted with C.Lee's approval (Oct 23, 2026, 6:39 PM PT).
Branch updated with mainMain was merged into Because merge commits created with GITHUB_TOKEN do not trigger workflows, a push to this branch or a manual CI re-run is needed for checks to run on it. Last synced: 2026-10-24T02:11:46.504Z |
|
Vercel preview access note removed (A-2177 secret-hygiene cleanup). |
Signed-off-by: Christopher Sellers <1@christophersellers.com>
PetrefiedThunder
left a comment
PetrefiedThunder
left a comment
There was a problem hiding this comment.
Reviewed diff of .github/workflows/vercel-preview-guard.yml. Accepts both the legacy (Preview – regengine / Vercel – regengine) and current (Preview / Vercel) env and context names for deployments, commit statuses and Vercel check runs. Hostname allowlist and the skip/fail rejection logic are unchanged. Dropping the environment filter from listDeployments is fine because the .find still matches sha + allowlisted env, and GitHub returns newest first. actionlint clean. Permissions are unchanged (read-only on the preview job), the action stays SHA-pinned, and HEAD_SHA is passed via env, so there is no injection. No data changes.
Non-blocking: plain Preview is generic. If a second Vercel project is ever linked to this repo, its deployment could match. Low risk today, and the hostname allowlist still applies.
REVIEW: PASS pi 04dddc7
Vercel now reports PR deployments with environment
Previewand commit statusVercel(notPreview – regengine/Vercel – regengine). Example: #3524 head 9cd1357 had a successful preview at 14:24 UTC, but Vercel Preview Built timed out after 25 minutes (run 39969090298). This accepts either naming and keeps the hostname allowlist and rejection logic unchanged. Not a required check. Merge freeze applies: do not merge until Lead lifts it.Note
Low Risk
CI-only workflow polling logic; no application runtime, auth, or data-path changes.
Overview
Fixes false Vercel Preview Built timeouts when Vercel reports deployments as
Preview/Vercelinstead of the legacyPreview – regengine/Vercel – regenginelabels.The wait script now treats either naming scheme as valid when matching GitHub deployments, commit statuses, and Vercel check runs. Deployment listing drops the API
environmentfilter and selects the SHA’s deployment if its environment is in the allowlist. Hostname allowlist and skip/fail rejection logic are unchanged.Reviewed by Cursor Bugbot for commit 5d3a4c8. Bugbot is set up for automated code reviews on this repo. Configure here.