Fix sizebot not working due to missing auth token (#26423)
Sizebot works by fetching the base artifacts from CI. CircleCI recently updated this endpoint to require an auth token. This is a problem for PR branches, where sizebot runs, because we don't want to leak the token to arbitrary code written by an outside contributor. This only affects PR branches. CI workflows that run on the main branch are allowed to access environment variables, because only those with push access can land code in main. As a temporary workaround, we'll fetch the assets from a mirror, react-builds.vercel.app. This is the same app that hosts the sizebot diff previews. Need to figure out a longer term solution. Perhaps by converting sizebot into a proper GitHub app.
Andrew Clark committed
Mar 18, 2023 at 16:22 UTC
842bd787a55df9a93c4c6e0f9b003f100c564b5e
1 file changed
+25
-3
.circleci/config.yml
+25
-3
@@ -151,11 +151,33 @@ jobs:
151
- setup_node_modules
152
- run:
153
name: Download artifacts for base revision
154
+ # TODO: The download-experimental-build.js script works by fetching
155
+ # artifacts from CI. CircleCI recently updated this endpoint to
156
+ # require an auth token. This is a problem for PR branches, where
157
+ # sizebot needs to run, because we don't want to leak the token to
158
+ # arbitrary code written by an outside contributor.
159
+ #
160
+ # This only affects PR branches. CI workflows that run on the main
161
+ # branch are allowed to access environment variables, because only those
162
+ # with push access can land code in main.
163
+ #
164
+ # As a temporary workaround, we'll fetch the assets from a mirror.
165
+ # Need to figure out a longer term solution for this.
166
+ #
167
+ # Original code
168
+ #
169
+ # command: |
170
+ # git fetch origin main
171
+ # cd ./scripts/release && yarn && cd ../../
172
+ # scripts/release/download-experimental-build.js --commit=$(git merge-base HEAD origin/main) --allowBrokenCI
173
+ # mv ./build ./base-build
174
+ #
175
+ # Workaround. Fetch the artifacts from react-builds.vercel.app. This
176
+ # is the same app that hosts the sizebot diff previews.
177
command: |
155
- git fetch origin main
156
- cd ./scripts/release && yarn && cd ../../
157
- scripts/release/download-experimental-build.js --commit=$(git merge-base HEAD origin/main) --allowBrokenCI
178
+ curl -L --retry 60 --retry-delay 10 --retry-max-time 600 https://react-builds.vercel.app/api/commits/$(git merge-base HEAD origin/main)/artifacts/build.tgz | tar -xz
179
mv ./build ./base-build
180
+
181
- run:
182
# TODO: The `download-experimental-build` script copies the npm
183
# packages into the `node_modules` directory. This is a historical