[ci] Use OIDC tokens to read private preview builds - #96919
Open
eps1lon wants to merge 4 commits into
Open
Conversation
Reading private preview builds no longer relies on the shared PREVIEW_BUILDS_READ_TOKEN secret. When NEXT_TEST_PREVIEW_BUILDS_ACCESS is "private" (sourced from the PREVIEW_BUILDS_ACCESS repository variable), scripts mint a GitHub Actions OIDC token for the audience that vercel-packages expects, and deploy builds authenticate with the VERCEL_OIDC_TOKEN that Vercel automatically provides, referenced from the generated .npmrc so no credential is uploaded with the deployment source. Preview tarball polling now fails fast on 401/403 instead of retrying, and failure messages include the response headers so request IDs are available for debugging. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Stats from current PR🔴 2 regressions, 1 improvement
📊 All Metrics📖 Metrics GlossaryDev Server Metrics:
Build Metrics:
Change Thresholds:
⚡ Dev Server
📦 Dev Server (Webpack) (Legacy)📦 Dev Server (Webpack)
⚡ Production Builds
📦 Production Builds (Webpack) (Legacy)📦 Production Builds (Webpack)
📦 Bundle SizesBundle Sizes⚡ TurbopackClient Main Bundles
Server Middleware
Build DetailsBuild Manifests
Build Cache
📦 WebpackClient Main Bundles
Polyfills
Pages
Server Edge SSR
Middleware
Build DetailsBuild Manifests
Build Cache
🔄 Shared (bundler-independent)Runtimes
📎 Tarball URLCommit: 665599b |
Contributor
Tests PassedCommit: 665599b |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
eps1lon
changed the title
The job needs id-token: write so that it can mint a token when preview builds are private. contents: read is made explicit since the synced workflow file also runs in the private mirror where checkout requires it. In this repo the permission stays dormant because preview builds are public and the script only mints when NEXT_TEST_PREVIEW_BUILDS_ACCESS is private. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
pnpm no longer expands environment variables in repository .npmrc files (GHSA-3qhv-2rgh-x77r), so referencing VERCEL_OIDC_TOKEN from a generated .npmrc would stop working once the pinned pnpm is updated past 10.33.0. Following the pattern used in vercel/front, deploy tests now write a vercel.json whose install command stores the shell-expanded token in the user-level pnpm config before installing, which keeps working on newer pnpm versions and still keeps credentials out of the uploaded deployment source. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
eps1lon
commented
Aug 7, 2026
Comment on lines
+739
to
+740
| # contents: read is needed to check out in private repos (the mirror). | ||
| contents: read |
Member
Author
There was a problem hiding this comment.
An install command writing the token to the user-level pnpm config made vercel deploy fail, so this stays on the repository .npmrc referencing VERCEL_OIDC_TOKEN. The pnpm expansion change (GHSA-3qhv-2rgh-x77r) will need a follow-up once the pinned pnpm moves past 10.33.0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
eps1lon
changed the title
eps1lon
marked this pull request as ready for review
August 7, 2026 17:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the shared, static
PREVIEW_BUILDS_READ_TOKENsecret with OIDC tokens for reading auth-protected preview builds from vercel-packages (see https://github.com/vercel/vercel-packages/pull/96):https://vercel-packages.vercel.appaudience.npmrcwritten that uses the Vercel OIDC tokenTarball polling now also fails fast on 401/403 (retrying can't change the authorization outcome) and failure messages include response headers so request IDs are available for debugging.
Test plan
nextfrom the protected route via the build'sVERCEL_OIDC_TOKENusing the preview deployment on https://github.com/vercel/vercel-packages/pull/96: e2e deploy test job -> vercel deployment (ignore the version, it was a dummy upload -> authorized request