Fix sizebot not working due to missing auth token (#26423)

Sizebot works by fetching the base artifacts from CI. CircleCI recently updated this endpoint to require an auth token. This is a problem for PR branches, where sizebot runs, because we don't want to leak the token to arbitrary code written by an outside contributor. This only affects PR branches. CI workflows that run on the main branch are allowed to access environment variables, because only those with push access can land code in main. As a temporary workaround, we'll fetch the assets from a mirror, react-builds.vercel.app. This is the same app that hosts the sizebot diff previews. Need to figure out a longer term solution. Perhaps by converting sizebot into a proper GitHub app.

Andrew Clark committed Mar 18, 2023 at 16:22 UTC 842bd787a55df9a93c4c6e0f9b003f100c564b5e

1 file changed +25 -3

.circleci/config.yml

+25 -3

@@ -151,11 +151,33 @@ jobs:

151 - setup_node_modules

152 - run:

153 name: Download artifacts for base revision

154 + # TODO: The download-experimental-build.js script works by fetching

155 + # artifacts from CI. CircleCI recently updated this endpoint to

156 + # require an auth token. This is a problem for PR branches, where

157 + # sizebot needs to run, because we don't want to leak the token to

158 + # arbitrary code written by an outside contributor.

159 + #

160 + # This only affects PR branches. CI workflows that run on the main

161 + # branch are allowed to access environment variables, because only those

162 + # with push access can land code in main.

163 + #

164 + # As a temporary workaround, we'll fetch the assets from a mirror.

165 + # Need to figure out a longer term solution for this.

166 + #

167 + # Original code

168 + #

169 + # command: |

170 + # git fetch origin main

171 + # cd ./scripts/release && yarn && cd ../../

172 + # scripts/release/download-experimental-build.js --commit=$(git merge-base HEAD origin/main) --allowBrokenCI

173 + # mv ./build ./base-build

174 + #

175 + # Workaround. Fetch the artifacts from react-builds.vercel.app. This

176 + # is the same app that hosts the sizebot diff previews.

177 command: |

155 - git fetch origin main

156 - cd ./scripts/release && yarn && cd ../../

157 - scripts/release/download-experimental-build.js --commit=$(git merge-base HEAD origin/main) --allowBrokenCI

178 + curl -L --retry 60 --retry-delay 10 --retry-max-time 600 https://react-builds.vercel.app/api/commits/$(git merge-base HEAD origin/main)/artifacts/build.tgz | tar -xz

179 mv ./build ./base-build

180 +

181 - run:

182 # TODO: The `download-experimental-build` script copies the npm

183 # packages into the `node_modules` directory. This is a historical