Point webapp Vercel deploys to new v6 project#2424
Conversation
Update vercel-prod.yaml and vercel-preview.yaml to use VERCEL_PROJECT_ID_V6 so main deploys go to the new v6 Vercel app, while the old VERCEL_PROJECT_ID secret remains for v4/v5 branches. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
WalkthroughTwo GitHub Actions workflow files were updated to reference a new Vercel project ID secret. The environment variable Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/vercel-prod.yaml (2)
18-18: 🧹 Nitpick | 🔵 TrivialOutdated checkout action version.
This uses
actions/checkout@v2while the preview workflow uses@v4. Consider updating for consistency and to benefit from security/performance improvements.Suggested fix
- - uses: actions/checkout@v2 + - uses: actions/checkout@v4
63-64:⚠️ Potential issue | 🟡 MinorProduction workflow uses unpinned
vercel@canary.Using
@canaryin production deployments introduces unpredictability—canary releases can include breaking changes or bugs. The preview workflow correctly pins tovercel@33.4.1. Consider pinning to the same stable version here for reproducible, secure deployments.Suggested fix (mirrors preview workflow pattern)
- - name: Install Vercel CLI - run: npm install --global vercel@canary - - name: Pull Vercel Environment Information - run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }} - - name: Deploy Project Artifacts to Vercel - run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }} packages/webapp + - name: Install Vercel CLI (local, pinned) + shell: bash --noprofile --norc -euo pipefail {0} + run: | + VERCEL_DIR="$(mktemp -d)" + npm install --no-audit --no-fund --no-save --prefix "$VERCEL_DIR" vercel@33.4.1 + echo "VERCEL_BIN=$VERCEL_DIR/node_modules/.bin/vercel" >> "$GITHUB_ENV" + - name: Pull Vercel Environment Information + shell: bash --noprofile --norc -euo pipefail {0} + env: + VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} + VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID_V6 }} + VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} + run: | + "$VERCEL_BIN" pull --yes --environment=production --token="$VERCEL_TOKEN" + - name: Deploy Project Artifacts to Vercel + shell: bash --noprofile --norc -euo pipefail {0} + env: + VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} + VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID_V6 }} + VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} + run: | + "$VERCEL_BIN" deploy --prebuilt --prod --token="$VERCEL_TOKEN" packages/webapp
🤖 Fix all issues with AI agents
In @.github/workflows/vercel-prod.yaml:
- Around line 1-4: Update the production workflow to match the preview
workflow's security hardening: upgrade the checkout action to the same version
used in preview (replace uses: actions/checkout@v2 with the preview pin, e.g.,
`@v4`), pin the Vercel CLI to the same fixed version (replace global `@canary` with
the pinned release used in preview) and install it locally so you can reference
its absolute path via the same $VERCEL_BIN variable when invoking the CLI, add
shell hardening flags (--noprofile --norc -euo pipefail) to relevant run steps,
and move VERCEL_* secrets from workflow-level env to the specific deployment
step-level env to match the preview workflow's secret scoping.
| name: GitHub Actions Vercel Production Deployment | ||
| env: | ||
| VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} | ||
| VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} | ||
| VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID_V6 }} |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
Secret reference updated correctly; consider aligning security hardening with the preview workflow.
The change to VERCEL_PROJECT_ID_V6 is correct. However, this production workflow lacks the security hardening present in vercel-preview.yaml:
| Aspect | Preview | Production |
|---|---|---|
| Checkout action | @v4 |
@v2 |
| Vercel CLI | Pinned 33.4.1, local install |
Unpinned @canary, global install |
| Shell hardening | --noprofile --norc -euo pipefail |
None |
| CLI invocation | $VERCEL_BIN (absolute path) |
vercel via PATH |
| Secret scope | Step-level env | Workflow-level env |
These are pre-existing issues, but since you're touching this file, it may be worth aligning both workflows for consistency and improved security posture—especially given the explicit security model documented in the preview workflow.
🤖 Prompt for AI Agents
In @.github/workflows/vercel-prod.yaml around lines 1 - 4, Update the production
workflow to match the preview workflow's security hardening: upgrade the
checkout action to the same version used in preview (replace uses:
actions/checkout@v2 with the preview pin, e.g., `@v4`), pin the Vercel CLI to the
same fixed version (replace global `@canary` with the pinned release used in
preview) and install it locally so you can reference its absolute path via the
same $VERCEL_BIN variable when invoking the CLI, add shell hardening flags
(--noprofile --norc -euo pipefail) to relevant run steps, and move VERCEL_*
secrets from workflow-level env to the specific deployment step-level env to
match the preview workflow's secret scoping.
|
@coderabbitai assess this PR size classification for the totality of the PR with the following criterias and report it in your comment: S/M/L PR Classification Guidelines:This guide helps classify merged pull requests by effort and complexity rather than just line count. The goal is to assess the difficulty and scope of changes after they have been completed. Small (S)Characteristics:
Review Effort: Would have taken 5-10 minutes Examples:
Medium (M)Characteristics:
Review Effort: Would have taken 15-30 minutes Examples:
Large (L)Characteristics:
Review Effort: Would have taken 45+ minutes Examples:
Additional Factors to ConsiderWhen deciding between sizes, also consider:
Notes:
|
|
The author of this PR is on the CodeRabbit Free Plan. In order to use the Chat feature, please upgrade the PR author to CodeRabbit Pro by visiting https://app.coderabbit.ai/login. |
2 participants
Update vercel-prod.yaml and vercel-preview.yaml to use VERCEL_PROJECT_ID_V6 so main deploys go to the new v6 Vercel app, while the old VERCEL_PROJECT_ID secret remains for v4/v5 branches.
Motivation
v5 is currently deployed to production on the existing Vercel app. Our plan only allows one custom environment per app, so v6 needs its own Vercel project. The old VERCEL_PROJECT_ID secret must remain for v4/v5 branches that still deploy to the original app.
Solution
Checks
By submitting this for review, I'm confirming I've done the following:
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.