ci: Comment the Vercel build log on PRs whose build fails - #1918
Closed
marcleblanc2 wants to merge 4 commits into
Closed
ci: Comment the Vercel build log on PRs whose build fails#1918marcleblanc2 wants to merge 4 commits into
marcleblanc2 wants to merge 4 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
marcleblanc2
enabled auto-merge (squash)
September 11, 2026 11:19
Vercel shows build logs only to members of its team, so contributors saw a red X and a login wall. On vercel.deployment.error this posts the tail of the build log on the PR; on the next successful build the same comment is updated to say the failure is fixed. Fork PRs are skipped so the project-scoped Vercel token is never used on their behalf.
…dispatch needs the file on main
Two open PRs at the same head SHA got one comment on whichever PR the
commits/{sha}/pulls API listed first. A deployment belongs to a commit,
so comment on each open PR at that head, fetching the build log once.
GitHub only resolves workflow_dispatch for workflows on the default
branch (gh workflow run --ref <branch> 404s before merge), so the header
now says to run the script locally until then.
Amp-Thread-ID: https://ampcode.com/threads/T-01a08fee-74b4-76dc-aaf9-d1245d68fdc9
Co-authored-by: Amp <amp@ampcode.com>
marcleblanc2
force-pushed
the
ci/vercel-build-failure-report
branch
from
September 11, 2026 16:41
d872028 to
b3f8143
Compare
Amp-Thread-ID: https://ampcode.com/threads/T-01a09014-dfa8-740c-95b4-9e28c43cae51 Co-authored-by: Amp <amp@ampcode.com>
This was referenced Sep 11, 2026
Merged
Closed
…omment cannot hold it The comment says how many lines the log has and that the last 100 are shown, matching tail -n 100. When that leaves lines out, the full log is uploaded as a workflow artifact and linked from the comment; the artifact ID rides in the comment marker so the run that reports the build passing deletes it. Amp-Thread-ID: https://ampcode.com/threads/T-01a09014-dfa8-740c-95b4-9e28c43cae51 Co-authored-by: Amp <amp@ampcode.com>
This was referenced Sep 11, 2026
Contributor
Author
|
Moved to #1946 (branch renamed to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When a PR's Vercel build fails, the results are paywalled behind the Vercel web UI, and very few people have access to them, leaving any of our doc contributors in the dark
Example: test: PR checks on a broken PR, left broken (do not merge) #1913
Solution
On
vercel.deployment.errorcomment the tail of the build log on the PROn the next
vercel.deployment.success, update that comment to ✅. The success path only reads Vercel's PR comments, it does not connect to VercelToken
VERCEL_TOKENrepo secret is a token scoped to thesourcegraph-docsproject only, expiry 2026-12-10 (3 months, and beyond when the docs migration to MSP should be complete)Vercel has no read-only scope for access tokens; project scope is the narrowest it offers
Fork PRs are skipped, and
repository_dispatchruns the version of the workflow and script onmain, so a malicious PR can't change the workflow to expose the tokenTested
Run locally against the two example PRs, which is how the comments there got posted (test comments show from my account, real comments will show from GH bot):
test: PR checks on a broken PR, left broken (do not merge) #1920: ❌ build log comment
test: PR checks on a broken PR, then remediated (do not merge) #1921: ❌ posted on a broken revision, then updated to ✅ after the fixed revision built
A PR with no failed build gets no comment
Every open PR at the failed commit gets the message
After merge, re-run on a PR by hand:
gh workflow run vercel-build-report.yml -f id=dpl_... -f state=error -f sha=<pr head sha>Dry-run output (abridged)
Amp thread
Merge order for the PR-check stack
Merge this PR first, so all subsequent PRs get the benefit of this output