unlyed / github-action-await-vercel

GitHub Action - Awaits a Vercel deployment to be ready

Unly

TERMS

TL;DR: Vulnerability disclosure must be sent to [email protected].

Read our Terms.

---

Security Researcher Hall of Fame

No vulnerability was ever disclosed to us, so far.

---

[ABOUT UNLY]

Unly is a socially responsible company, fighting inequality and facilitating access to higher education. Unly is committed to making education more inclusive, through responsible funding for students.

We provide technological solutions to help students find the necessary funding for their studies.

We proudly participate in many TechForGood initiatives. To support and learn more about our actions to make education accessible, visit :

• https://twitter.com/UnlyEd
• https://www.facebook.com/UnlyEd/
• https://www.linkedin.com/company/unly
• Interested to work with us?

Tech tips and tricks from our CTO on our Medium page!

#TECHFORGOOD #EDUCATIONFORALL

github-action-await-vercel's Issues

v1.2.13 seems to be broken

Describe the bug

v1.2.13 seems to be broken

To Reproduce
Steps to reproduce the behavior:

1. See the update here: https://github.com/ismay/superwolff/pull/283
2. Error happens here: https://github.com/ismay/superwolff/pull/283/checks?check_run_id=3765971318

Expected behavior

Before the update the action worked fine for many runs. Now it consistently crashes.

Screenshots

Environment (please complete the following information):

• Github CI

Migrate "set-output" to new "environment files" before end of May 2023

https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/

To avoid untrusted logged data to use save-stateand set-output workflow commands without the intention of the workflow author we have introduced a new set of environment files to manage state and output.

Starting today runner version 2.298.2 will begin to warn you if you use the save-state or set-output commands via stdout. We are monitoring telemetry for the usage of these commands and plan to fully disable them on 31st May 2023. Starting 1st June 2023 workflows using save-state or set-output commands via stdout will fail with an error.

https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#environment-files

We use a deprecated way to store/log variables, and this will completely break the Action unless migrated before end of May 2023.

Related to #74

Use Node.js 20

Is your feature request related to a problem? Please describe.
Using this action shows deprecation warnings "Node.js 16 actions are deprecated. " on github

Describe the solution you'd like
Update to Node.js 20

Describe alternatives you've considered
https://github.com/patrickedqvist/wait-for-vercel-preview is a similar action, but it is also still on Node 16

Additional context
https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/

Vercel timeout

Describe the bug
We have some longer deploy times and use this to correctly enforce the result status of the vercel deployment, but after enabling debug mode, we noticed that after a while, the vercel request will timeout

FetchError: request to https://api.vercel.com/v11/now/deployments/get?url=********.vercel.app failed, reason: connect ETIMEDOUT 76.76.21.112:443

I think this is a ddos protection on vercel's side

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
It would be really helpful if we could configure the retry step (eg: as opposed to checking status every 5 seconds, we can do it every 30 seconds)

Much appreciated

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: [e.g. iOS]
• Browser [e.g. chrome, safari]
• Version [e.g. 22]

Smartphone (please complete the following information):

• Device: [e.g. iPhone6]
• OS: [e.g. iOS8.1]
• Browser [e.g. stock browser, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

Update paambaati/[email protected] (node16 support)

https://github.com/paambaati/codeclimate-action/releases, node v16 was added for v3.1, but v3.1 is broken, need to use v3.2.0

Reference SHAs instead of refs for external GitHub Actions in ".workflows"

Is your feature request related to a problem? Please describe.
It's unsafe to reference refs, it's safer to references SHAs, especially if we provide Secrets or other sensitive information.

Describe the solution you'd like
We might use something like https://github.com/mheap/pin-github-action and have scripts that run it against our workflows files. And automate it somehow, so that it is enforced.

Describe alternatives you've considered
Doing it manually. Not great DX.

Additional context
https://michaelheap.com/improve-your-github-actions-security/

Use Actions Tagger to provide an up-to-date major tag and keep it up-to-date automatically

Is your feature request related to a problem? Please describe.
People might want to use our Action using a major tag that is automatically updated to include security patches, and similar (e.g: v1 instead of v1.1.0). Using https://github.com/marketplace/actions/actions-tagger would help us to do so automatically, while providing a tag specific for each release.

This way, people can either lock into a release (e.g: v1.1.1) that we won't update (by convention, even though it's technically possible), or use a major version (e.g: v1) which will automatically be updated when a new minor/patch tag is released.

Describe the solution you'd like
Use https://github.com/marketplace/actions/actions-tagger to provide a major tag that's keeping our tags up to date.

Additional context
https://github.com/marketplace/actions/actions-tagger
https://michaelheap.com/semantic-versioning-for-github-actions/

What is `nextjs-bzyss249z.vercel.app`

Hi, I've come across this action from the depreciated wait for vercel action

I'm looking to use this as wait for vercel doesn't seem to wait for the deployed URL

I'm looking at the documentation and it's not really clear what this section is for:

    steps:
      - name:
          Retrieve deployment URL (example on how to set an ENV var)
        run:
          'echo VERCEL_DEPLOYMENT_URL=nextjs-bzyss249z.vercel.app >>
          $GITHUB_ENV'

Is nextjs-bzyss249z.vercel.app the base URL? So if I'm doing this for Google it'd be google.com??

It's confusing because the url looks like a generated on, like one a build would be on before getting pushed to the production URL say, understand?

What I'm trying to say is it looks like that url is a generated temporary url and I don't know where that would come from

This is from my current workflow and that url is generated by vercel, it looks like you want me to pass in the generated url. defeating the purpose of the workflow

Vercel readyState: READY too soon

Discussed in #63

^{Originally posted by azamat-sharapov October 21, 2022}
Hi. For some reason, plugin resolves almost immediately. I turned on debugging and found out that Vercel responds with readyState: READY, however the deployment was still in progress. I'm not sure what could be causing this and asking for help.

Workflow

# ...

jobs:
  production-deployment:
    runs-on: ubuntu-latest
    steps:
      - uses: UnlyEd/[email protected]
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
        with:
          deployment-url: company-url-here
          timeout: 300

# ...

Vercel response when debugging enabled

{
  "alias": [
    "company-url-here",
  ],
  "aliasAssigned": true,
  "aliasError": null,
  "bootedAt": 1662716931099,
  "buildingAt": 1662716931995,
  "createdAt": 1662716931099,
  "creator": {
    "uid": "xK3EnMryM6wzb1qvbNna0oue",
    "username": "azamat-sharapov"
  },
  "gitSource": {
    "ref": "production",
    "repoId": 264885110,
    "sha": "...",
    "type": "github",
    "prId": null
  },
  "id": "...",
  "initReadyAt": 1662717060554,
  "lambdas": [
    {
      "id": "...",
      "createdAt": 1662716931148,
      "entrypoint": null,
      "readyState": "READY",
      "readyStateAt": 1662716931148,
      "output": []
    },
    {
      "id": "...",
      "createdAt": 1662716935106,
      "entrypoint": ".",
      "output": []
    }
  ],
  "name": "project-name-here",
  "meta": {
    "githubCommitAuthorName": "Azamat",
    "githubCommitMessage": "Production deployment version 85.0",
    "githubCommitOrg": "Company Name",
    "githubCommitRef": "production",
    "githubCommitRepo": "project-repo",
    "githubCommitSha": "...",
    "githubDeployment": "1",
    "githubOrg": "Company Name",
    "githubRepo": "project-name",
    "githubCommitRepoId": "...",
    "githubRepoId": "...",
    "githubCommitAuthorLogin": "azamat-sharapov"
  },
  "public": false,
  "ready": 1662717060554,
  "readyState": "READY",
  "regions": [
    "fra1"
  ],
  "source": "git",
  "status": "READY",
  "target": "production",
  "team": {
    "id": "...",
    "name": "Team Name",
    "slug": "team-name"
  },
  "type": "LAMBDAS",
  "url": "random-url-by-vercel",
  "version": 2,
  "aliasAssignedAt": 1662717061128,
  "build": {
    "env": [
      "CI",
      "VERCEL",
      "VERCEL_ENV",
      "TURBO_REMOTE_ONLY",
      "VERCEL_URL",
      "VERCEL_GIT_PROVIDER",
      "VERCEL_GIT_PREVIOUS_SHA",
      "VERCEL_GIT_REPO_SLUG",
      "VERCEL_GIT_REPO_OWNER",
      "VERCEL_GIT_REPO_ID",
      "VERCEL_GIT_COMMIT_REF",
      "VERCEL_GIT_COMMIT_SHA",
      "VERCEL_GIT_COMMIT_MESSAGE",
      "VERCEL_GIT_COMMIT_AUTHOR_LOGIN",
      "VERCEL_GIT_COMMIT_AUTHOR_NAME",
      "SENTRY_AUTH_TOKEN",
      "VUE_APP_SENTRY_DSN",
      "VUE_APP_SEGMENT_AUTH_TOKEN",
      "VERCEL_BUILD_OUTPUTS_EDGE_FUNCTION",
      "VERCEL_EDGE_FUNCTIONS_STRICT_MODE",
      "USE_OUTPUT_FOR_EDGE_FUNCTIONS",
      "NEXT_PRIVATE_MULTI_PAYLOAD",
      "ENABLE_ROOT_PATH_BUILD_CACHE"
    ]
  },
  "builds": [],
  "createdIn": "sfo1",
  "env": [],
  "functions": null,
  "inspectorUrl": "...",
  "ownerId": "...",
  "plan": "pro",
  "projectId": "...",
  "projectSettings": {
    "buildCommand": "pnpm run vercel-build",
    "devCommand": null,
    "framework": "vue",
    "commandForIgnoringBuildStep": null,
    "installCommand": "pnpm install",
    "outputDirectory": null
  },
  "routes": [
    {
      "src": "^/[^/]*\\.(js|txt|ico|json)$",
      "headers": {
        "cache-control": "max-age=300"
      },
      "continue": true
    },
    {
      "src": "^/(img|js|css|fonts|media)/[^/]+\\.[0-9a-f]{8}\\.*$",
      "headers": {
        "cache-control": "max-age=31536000, immutable"
      },
      "continue": true
    },
    {
      "handle": "error"
    },
    {
      "status": 404,
      "src": "^(?!/api).*$",
      "dest": "/404.html"
    },
    {
      "handle": "filesystem"
    },
    {
      "src": "^.*$",
      "dest": "/index.html"
    }
  ]
}

Upgrade from node12 to node16

https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions

Must-have.

Node 12 has been out of support since April 2022, as a result we have started the deprecation process of Node 12 for GitHub Actions. We plan to migrate all actions to run on Node16 by Summer 2023. We will monitor the progress of the migration and listen to the community for how things are going before we define a final date.
To raise awareness of the upcoming change, we are adding a warning into workflows which contain Actions running on Node 12. This will come into effect starting on September 27th.

Related to #74

Deprecated features - set-output and node.js 12

Running your action in my workflow I get these warnings:

According to the links attached to warning, both will throw errors starting in June. Are you planning to fix it?

Update PaulHatch/semantic-version (node16 support)

PaulHatch/semantic-version#83

No changelog from v3 to v5, not sure if I might break something

Update marvinpinto/action-automatic-releases (node16 support)

marvinpinto/actions#543

No support for node16 yet