feat(ci): point extension PR preview at author's freighter-config sandbox

[piyalbasu]

TL;DR

Makes the browser-extension PR-preview build point at the PR author's own per-engineer sandbox backend instead of shared staging, by looking the author up in freighter-config at build time. If the author has no sandbox entry (or the map can't be read), it falls back to public staging and says so — the preview is never broken, just clearly labeled. The extension counterpart to freighter-mobile#947.

Part of the Fullstack PR Preview Flow, Phase 2 (extension).

Implementation details (for agents)

What changed — all in .github/workflows/prPreview.yml:

• New Fetch freighter-config step, immediately after checkout and before any PR-controlled code (yarn, build). Clones the private stellar/freighter-config over SSH using a read-only, extension-scoped deploy key (secrets.FREIGHTER_CONFIG_DEPLOY_KEY), writes config.json to $RUNNER_TEMP, and tears the key down in-step (mode-600 tempfile + trap … EXIT). Never fails the build.
• New Resolve backend URLs step maps pull_request.user.login → sandbox v1/v2 and writes INDEXER_URL/INDEXER_V2_URL to $GITHUB_ENV. Those two keys were removed from job-level env: to avoid a job-env:-vs-$GITHUB_ENV precedence ambiguity; the webpack build (yarn build:extension:production) reads them from the process env. Empty-URL validation folds into this step, replacing the old standalone "Validate required secrets" step.
• Fallback + labeling: no entry → staging; config unreachable → staging + preview-degraded label (gh label create … || true create-if-missing, then add/remove so a fixed re-run self-corrects). Added issues: write solely for creating the label definition.
• Release notes + sticky comment now interpolate BACKEND_DESC (sandbox (login) / staging — no sandbox configured / staging — freighter-config unreachable).

Resolve logic: https://github.com/stellar/freighter/blob/d498c9a8838cd3fdf5ddce5e18768d5a215577a8/.github/workflows/prPreview.yml

Security: unchanged posture — pull_request-only + fork-guard, deploy key read-only + scoped to freighter-config + torn down before PR code runs. Only new outbound is the SSH clone of one private repo.

Depends on (land first):

1. stellar/terraform#6556 — registers the extension read-only deploy key on freighter-config.
   (The FREIGHTER_CONFIG_DEPLOY_KEY secret is already set on this repo; freighter-config schema + entries already exist.)

Verification: YAML validated pre/post husky/prettier; the two INDEXER vars now appear only in the resolve step (fallback + $GITHUB_ENV writes), not job env. Full e2e (author piyalbasu → sandbox URLs baked) requires #6556 to land first.

Note: URL shape parity — config v1/v2 carry the /api/v1 suffix (shared with mobile). If the extension's INDEXER_* secrets use a different shape, adjust; the e2e preview will surface any mismatch.

[github-actions]

PR Preview build is ready: https://github.com/stellar/freighter/releases/tag/untagged-15f6a3a2dff6b001284f
Backend: V1 prod + V2 beta — freighter-config unreachable (preview degraded). SDF collaborators only — install instructions in the release description.

[Copilot]

Pull request overview

Routes extension PR previews to each author’s sandbox backend, with fallback status surfaced in GitHub.

Changes:

• Fetches sandbox mappings from freighter-config.
• Resolves and injects backend URLs with staging fallback.
• Updates labels, release notes, and sticky comments with backend status.

Comments suppressed due to low confidence (3)

.github/workflows/prPreview.yml:150

• A successful clone marks any existing file as available, but these jq assignments run under set -e: invalid JSON exits the job instead of taking the promised staging fallback, while non-string/multiline values can later corrupt $GITHUB_ENV. Validate the config's JSON/schema and single-line URL fields before setting config_available=true; treat validation failure as unavailable.

          if [ "${CONFIG_AVAILABLE}" = "true" ]; then
            V1_URL=$(jq -r --arg u "$PR_AUTHOR" '.engineers[$u].v1 // empty' "$CONFIG_OUT")
            V2_URL=$(jq -r --arg u "$PR_AUTHOR" '.engineers[$u].v2 // empty' "$CONFIG_OUT")

.github/workflows/prPreview.yml:146

• The cached file contains the entire map from a private repository and survives this step, so the later PR-controlled yarn/build scripts can read and exfiltrate it even though the deploy key was deleted. Remove the cached config on exit from this resolve step, before any PR code executes.

          CONFIG_OUT="${RUNNER_TEMP}/freighter-config.json"
          V1_URL=""; V2_URL=""; TARGET=""; DESC=""; DEGRADED="false"

.github/workflows/prPreview.yml:158

• These descriptions call the fallback “staging,” but the fallback values are unchanged: secrets.INDEXER_URL was documented immediately above this diff as V1 production because V1 staging has no public DNS, while V2 uses beta. The release and sticky comment will therefore mislabel the actual backend. Either provide a public V1 staging URL or describe the mixed V1-production/V2-beta fallback accurately.

              TARGET="staging"; DESC="staging — no sandbox configured for @${PR_AUTHOR}"
            fi
          else
            TARGET="staging-degraded"; DEGRADED="true"
            DESC="staging — freighter-config unreachable (preview degraded)"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.