Auto-build and open a PR to publish public/ on push to master#31
Open
eudanielhenrique wants to merge 1 commit into
Open
Auto-build and open a PR to publish public/ on push to master#31eudanielhenrique wants to merge 1 commit into
eudanielhenrique wants to merge 1 commit into
Conversation
Closes the "Make autobuilder instead of manual build and push" TO-DO item. Vercel serves the project straight from the committed public/ directory (see vercel.json), so someone has always had to remember to run `npm run build` and commit the output by hand. That already went stale at least once — the `synthwave` theme was in src/data/themes.ts but never made it into public/src/data/themes.js. Adds two workflows: - ci.yml: runs `npm run build` on every PR and push, as a check. - build.yml: on push to master, builds and, if public/ drifted, opens a PR with the rebuilt output (using peter-evans/create-pull-request) rather than pushing to master directly — a human still reviews and merges it. Also, while making the build reproducible in CI: - Committed package-lock.json (was gitignored, so every install could silently resolve different transitive dependency versions — this is almost certainly why the build had a persistent, unrelated TS type error locally: an unpinned newer @types/node conflicting with TypeScript's own DOM lib types). - Bumped @types/node from a 2021-era ^15.12.1 to ^20.19.43, which resolves that exact conflict — `npm run build` now completes with zero errors instead of one persistent (if harmless) one. - Bumped axios from ^0.21.1 to ^1.18.1. The old version has a long list of high-severity advisories (SSRF, credential leakage via proxy/redirect handling, prototype pollution) and axios is an actual runtime dependency here (fetching the user's avatar and profile data), not just a dev tool. Usage in this codebase is limited to plain axios.get() calls, which are unaffected by the v0->v1 API changes.
|
@eudanielhenrique is attempting to deploy a commit to the Jurre's projects Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the "Make autobuilder instead of manual build and push" TO-DO item.
Vercel serves the project straight from the committed
public/directory (seevercel.json), so someone has always had to remember to runnpm run buildand commit the output by hand. That had already gone stale at least once — thesynthwavetheme was insrc/data/themes.tsbut never made it intopublic/src/data/themes.js.Adds two workflows:
ci.yml: runsnpm run buildon every PR and push, as a check.build.yml: on push tomaster, builds and, ifpublic/drifted, opens a PR with the rebuilt output (viapeter-evans/create-pull-request) rather than pushing tomasterdirectly — a human still reviews and merges it, no standing write access is used to bypass review.Also, while making the build reproducible in CI:
package-lock.json(was gitignored, so every install could silently resolve different transitive dependency versions — this is almost certainly why the build had a persistent, unrelated TS type error locally: an unpinned newer@types/nodeconflicting with TypeScript's own DOM lib types).@types/nodefrom a 2021-era^15.12.1to^20.19.43, which resolves that exact conflict —npm run buildnow completes with zero errors instead of one persistent (if harmless) one.axiosfrom^0.21.1to^1.18.1. The old version has a long list of high-severity advisories (SSRF, credential leakage via proxy/redirect handling, prototype pollution) and axios is an actual runtime dependency here (fetching the user's avatar and profile data), not just a dev tool. Usage in this codebase is limited to plainaxios.get()calls, unaffected by the v0→v1 API changes.Test plan
npm ci && npm run buildfrom a cleannode_modules— reproducible, zero errorspublic/now includes the previously-missingsynthwavetheme