[pull] canary from vercel:canary - #1366
Merged
Merged
Conversation
So I was playing around with profiling some very simple next apps when I noticed this. Basically, because of how things were set up we were spending a good chunk of our build time analyzing files we were going to reject. I went around and around trying different combinations to make sure we ignore those files (and only the files we should ignore) to speed up build times. Since it is a constant impact, mostly on small projects, but on some, it can make a big difference. I had some adversarial rounds with agents to see if they can break the config in the ways the old comments hints at why we didn't do that. And this final round finally couldn't get it to break. For a v0-generated Hello World app, compile time is 28.0% faster (+/-1.7%) and a full clean build is 15.9% faster (+/- 1.2%). --------- Co-authored-by: Niklas Mischkulnig <4586894+mischnic@users.noreply.github.com>
## Summary - add a manually dispatchable workflow; the hourly schedule is left commented until initial production verification - keep the workflow YAML small and place delivery in `.github/scripts/next-maintainer-auto-close.js` for normal code review - use a short-lived exact-audience GitHub Actions OIDC token with no long-lived secret - trust the authenticated queue contract instead of reimplementing its Zod validation in the workflow - post the verifier-authored comment and close with GitHub native completed, not planned, or duplicate state reasons - retain one invisible marker only to prevent duplicate public comments across retries If an issue is open with the marker, the workflow leaves it open. This intentionally lets a human reopen win and avoids timeline reconstruction. ## Permissions The job grants only `contents: read`, `id-token: write`, and `issues: write`; every other permission remains none. Both GitHub actions are pinned to full commit SHAs. Checkout is sparse to the one trusted JavaScript file and has credential persistence disabled. ## Verification - mocked delivery harness passes ten scenarios: empty queue, completed, not planned, duplicate, pull-request rejection, already-closed recovery, independent close, open marker, transferred issue, and transient failure - `node --check`, Prettier, and ESLint pass for the extracted implementation - Vercel Agent Review, Vercel Security Review, Socket Security, workflow change detection, and documentation validation pass - after merge, dispatch the registered workflow on `canary` and add the production run link here before enabling the hourly schedule ## Dependency This is the narrow GitHub write-side companion to vercel-labs/next-maintainer-agent#541, which is deployed. vercel-labs/next-maintainer-agent#546 further reduces the queue DTO and changes the delivery limit to 25 first claims per rolling week; this workflow is compatible with both DTO versions.
## Summary - return `400 Bad Request` when a Server Action reference ID does not match the expected format - return `409 Conflict` when a well-formed action ID is unavailable in the current deployment, including deployment skew - apply the same classification to IDs from the `Next-Action` header and multipart MPA forms, including direct and bound actions in Node and Edge runtimes - return generic text bodies matching the client error category, without exposing action-ID details - derive marked forwarded-action responses from the original action ID so an unexpected or mixed-version worker response cannot change the client error semantics Fetch actions previously had dedicated 404 handling, while equivalent MPA form submissions fell through to the generic error path and returned 500. This removes that transport-dependent behavior and distinguishes malformed or scanning traffic from legitimate stale clients without treating either case as a missing page or an internal server failure. ## Verification - `pnpm test-dev-turbo test/e2e/app-dir/actions-unrecognized/actions-unrecognized.test.ts` - `pnpm test-dev-turbo test/e2e/app-dir/actions/app-action.test.ts -t 'forward.*action'` - `pnpm test-start-turbo test/e2e/app-dir/actions-unrecognized/actions-unrecognized.test.ts` - `pnpm test-dev-webpack test/e2e/app-dir/actions-unrecognized/actions-unrecognized.test.ts` - `pnpm test-dev-turbo test/e2e/app-dir/no-server-actions/no-server-actions.test.ts` <!-- NEXT_JS_LLM -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )