fix: examples/with-unsplash/package.json to reduce vulnerabilities #6
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
name: build-and-deploy | |
on: | |
push: | |
branches: ['canary'] | |
workflow_dispatch: | |
env: | |
NAPI_CLI_VERSION: 2.14.7 | |
TURBO_VERSION: 1.10.9 | |
NODE_MAINTENANCE_VERSION: 16 | |
NODE_LTS_VERSION: 18.16.1 | |
CARGO_PROFILE_RELEASE_LTO: 'true' | |
jobs: | |
build: | |
runs-on: ubuntu-latest | |
env: | |
NEXT_TELEMETRY_DISABLED: 1 | |
# we build a dev binary for use in CI so skip downloading | |
# canary next-swc binaries in the monorepo | |
NEXT_SKIP_NATIVE_POSTINSTALL: 1 | |
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }} | |
outputs: | |
isRelease: ${{ github.event_name != 'workflow_dispatch' && steps.check-release.outputs.IS_RELEASE }} | |
steps: | |
- name: Setup node | |
uses: actions/setup-node@v3 | |
with: | |
node-version: ${{ env.NODE_LTS_VERSION }} | |
check-latest: true | |
- run: corepack enable | |
- uses: actions/checkout@v3 | |
with: | |
fetch-depth: 25 | |
- id: get-store-path | |
run: echo STORE_PATH=$(pnpm store path) >> $GITHUB_OUTPUT | |
- uses: actions/cache@v3 | |
timeout-minutes: 5 | |
id: cache-pnpm-store | |
with: | |
path: ${{ steps.get-store-path.outputs.STORE_PATH }} | |
key: pnpm-store-${{ hashFiles('pnpm-lock.yaml') }} | |
restore-keys: | | |
pnpm-store- | |
pnpm-store-${{ hashFiles('pnpm-lock.yaml') }} | |
- run: pnpm install | |
- run: pnpm run build | |
- id: check-release | |
run: | | |
if [[ $(node ./scripts/check-is-release.js 2> /dev/null || :) = v* ]]; | |
then | |
echo "IS_RELEASE=true" >> $GITHUB_OUTPUT | |
else | |
echo "IS_RELEASE=false" >> $GITHUB_OUTPUT | |
fi | |
- uses: actions/cache@v3 | |
timeout-minutes: 5 | |
id: cache-build | |
with: | |
path: ./* | |
key: ${{ github.sha }}-${{ github.run_number }} | |
# Build binaries for publishing | |
build-native: | |
strategy: | |
fail-fast: false | |
matrix: | |
settings: | |
# pnpm is aliased here temporarily until the build docker | |
# image is updated past Node.js v14.19 (current 14.18.1) | |
- host: macos-latest | |
target: 'x86_64-apple-darwin' | |
build: | | |
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi | |
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target x86_64-apple-darwin --release | |
strip -x packages/next-swc/native/next-swc.*.node | |
- host: windows-latest | |
build: | | |
corepack enable | |
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" | |
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target x86_64-pc-windows-msvc | |
target: 'x86_64-pc-windows-msvc' | |
- host: windows-latest | |
build: | | |
corepack enable | |
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" | |
turbo run build-native-no-plugin --remote-cache-timeout 90 --summarize -- --release --target i686-pc-windows-msvc | |
target: 'i686-pc-windows-msvc' | |
- host: ubuntu-latest | |
target: 'x86_64-unknown-linux-gnu' | |
docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:stable-2022-10-24-x64 | |
build: >- | |
set -e && | |
apt update && | |
apt install -y pkg-config && | |
rustup toolchain install "${RUST_TOOLCHAIN}" && | |
rustup default "${RUST_TOOLCHAIN}" && | |
rustup target add x86_64-unknown-linux-gnu && | |
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi && | |
unset CC_x86_64_unknown_linux_gnu && unset CC && | |
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target x86_64-unknown-linux-gnu && | |
strip packages/next-swc/native/next-swc.*.node | |
- host: ubuntu-latest | |
target: 'x86_64-unknown-linux-musl' | |
docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:stable-2022-10-24-alpine | |
build: >- | |
set -e && | |
apk add --no-cache libc6-compat pkgconfig && | |
rustup toolchain install "${RUST_TOOLCHAIN}" && | |
rustup default "${RUST_TOOLCHAIN}" && | |
rustup target add x86_64-unknown-linux-musl && | |
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi && | |
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target x86_64-unknown-linux-musl && | |
strip packages/next-swc/native/next-swc.*.node | |
- host: macos-latest | |
target: 'aarch64-apple-darwin' | |
build: | | |
sudo rm -Rf /Library/Developer/CommandLineTools/SDKs/*; | |
export CC=$(xcrun -f clang); | |
export CXX=$(xcrun -f clang++); | |
SYSROOT=$(xcrun --sdk macosx --show-sdk-path); | |
export CFLAGS="-isysroot $SYSROOT -isystem $SYSROOT"; | |
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi | |
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target aarch64-apple-darwin | |
strip -x packages/next-swc/native/next-swc.*.node | |
- host: ubuntu-latest | |
target: 'aarch64-unknown-linux-gnu' | |
docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:stable-2022-10-24-aarch64 | |
build: >- | |
set -e && | |
apt update && | |
apt install -y pkg-config && | |
export JEMALLOC_SYS_WITH_LG_PAGE=16 && | |
rustup toolchain install "${RUST_TOOLCHAIN}" && | |
rustup default "${RUST_TOOLCHAIN}" && | |
rustup target add aarch64-unknown-linux-gnu && | |
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi && | |
export CC_aarch64_unknown_linux_gnu=/usr/aarch64-unknown-linux-gnu/bin/aarch64-unknown-linux-gnu-gcc && | |
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target aarch64-unknown-linux-gnu --features plugin,rustls-tls,tracing/release_max_level_info && | |
llvm-strip -x packages/next-swc/native/next-swc.*.node | |
- host: ubuntu-latest | |
target: 'aarch64-unknown-linux-musl' | |
docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:stable-2022-10-24-alpine | |
build: >- | |
set -e && | |
apk add --no-cache libc6-compat pkgconfig && | |
export JEMALLOC_SYS_WITH_LG_PAGE=16 && | |
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi && | |
rustup toolchain install "${RUST_TOOLCHAIN}" && | |
rustup default "${RUST_TOOLCHAIN}" && | |
rustup target add aarch64-unknown-linux-musl && | |
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target aarch64-unknown-linux-musl && | |
llvm-strip -x packages/next-swc/native/next-swc.*.node | |
- host: windows-latest | |
target: 'aarch64-pc-windows-msvc' | |
build: | | |
corepack enable | |
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" | |
turbo run build-native-no-plugin-woa-release --remote-cache-timeout 90 --summarize -- --target aarch64-pc-windows-msvc | |
name: stable - ${{ matrix.settings.target }} - node@16 | |
runs-on: ${{ matrix.settings.host }} | |
env: | |
TURBO_TEAM: 'vercel' | |
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }} | |
TURBO_REMOTE_ONLY: 'true' | |
steps: | |
# https://github.com/actions/virtual-environments/issues/1187 | |
- name: tune linux network | |
run: sudo ethtool -K eth0 tx off rx off | |
if: ${{ matrix.settings.host == 'ubuntu-latest' }} | |
- name: tune linux network | |
run: sudo ethtool -K eth0 tx off rx off | |
if: ${{ matrix.settings.host == 'ubuntu-latest' }} | |
- name: tune windows network | |
run: Disable-NetAdapterChecksumOffload -Name * -TcpIPv4 -UdpIPv4 -TcpIPv6 -UdpIPv6 | |
if: ${{ matrix.settings.host == 'windows-latest' }} | |
- name: tune mac network | |
run: sudo sysctl -w net.link.generic.system.hwcksum_tx=0 && sudo sysctl -w net.link.generic.system.hwcksum_rx=0 | |
if: ${{ matrix.settings.host == 'macos-latest' }} | |
# we use checkout here instead of the build cache since | |
# it can fail to restore in different OS' | |
- uses: actions/checkout@v3 | |
- name: Setup node | |
uses: actions/setup-node@v3 | |
if: ${{ !matrix.settings.docker }} | |
with: | |
node-version: ${{ env.NODE_LTS_VERSION }} | |
check-latest: true | |
- name: Install Rust | |
uses: ./.github/actions/setup-rust | |
with: | |
targets: ${{ matrix.settings.target }} | |
skip-install: ${{ matrix.settings.docker }} | |
- name: Cache cargo registry | |
uses: actions/cache@v3 | |
timeout-minutes: 5 | |
with: | |
path: ~/.cargo/registry | |
key: ${{ matrix.settings.target }}-cargo-registry | |
- name: Cache cargo index | |
uses: actions/cache@v3 | |
timeout-minutes: 5 | |
with: | |
path: ~/.cargo/git | |
key: ${{ matrix.settings.target }}-cargo-index | |
- name: normalize versions | |
run: node scripts/normalize-version-bump.js | |
- name: Setup toolchain | |
run: ${{ matrix.settings.setup }} | |
if: ${{ matrix.settings.setup }} | |
shell: bash | |
- name: Build in docker | |
uses: addnab/docker-run-action@v3 | |
if: ${{ matrix.settings.docker }} | |
with: | |
image: ${{ matrix.settings.docker }} | |
options: >- | |
-e RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }} | |
-e CARGO_INCREMENTAL=${{ env.CARGO_INCREMENTAL }} | |
-e CARGO_PROFILE_RELEASE_LTO=${{ env.CARGO_PROFILE_RELEASE_LTO }} | |
-e CARGO_TERM_COLOR=${{ env.CARGO_TERM_COLOR }} | |
-e RUST_BACKTRACE=${{ env.RUST_BACKTRACE }} | |
-e CARGO_REGISTRIES_CRATES_IO_PROTOCOL=${{ env.CARGO_REGISTRIES_CRATES_IO_PROTOCOL }} | |
-e NAPI_CLI_VERSION=${{ env.NAPI_CLI_VERSION }} | |
-e TURBO_VERSION=${{ env.TURBO_VERSION }} | |
-e TURBO_TEAM=vercel | |
-e TURBO_TOKEN=${{ secrets.TURBO_TOKEN }} | |
-e TURBO_REMOTE_ONLY=true | |
-v ${{ env.HOME }}/.cargo/git:/root/.cargo/git | |
-v ${{ env.HOME }}/.cargo/registry:/root/.cargo/registry | |
-v ${{ github.workspace }}:/build | |
-w /build | |
run: ${{ matrix.settings.build }} | |
- name: 'Build' | |
run: ${{ matrix.settings.build }} | |
if: ${{ !matrix.settings.docker }} | |
shell: bash | |
- name: 'check build cache status' | |
id: check-did-build | |
shell: bash | |
run: if [[ ! -z $(ls .turbo/runs) ]]; then echo "DID_BUILD=yup" >> $GITHUB_OUTPUT; fi | |
# Trying to upload metrics for the Turbopack to datadog's CI pipeline execution | |
- name: 'Collect turbopack build metrics' | |
id: check-turbopack-bytesize | |
shell: bash | |
if: ${{ steps.check-did-build.outputs.DID_BUILD == 'yup' }} | |
continue-on-error: true | |
run: | | |
mkdir -p ./turbopack-bin-size | |
shopt -s nullglob | |
for filename in packages/next-swc/native/next-swc.*.node; do | |
# Strip out filename to extract target triple | |
export FILENAME=$(basename ${filename}) | |
export FILENAME=${FILENAME#*.} | |
export FILENAME=${FILENAME%.node} | |
export BYTESIZE=$(wc -c < $filename | xargs) | |
echo "Reporting $FILENAME:$BYTESIZE for Turbopack bytesize" | |
echo "turbopack.bytesize.$FILENAME:$BYTESIZE" > ./turbopack-bin-size/${{ matrix.settings.target }} | |
done | |
- name: Upload turbopack bytesize artifact | |
if: ${{ steps.check-did-build.outputs.DID_BUILD == 'yup' }} | |
uses: actions/upload-artifact@v3 | |
with: | |
name: turbopack-bytesize | |
path: turbopack-bin-size/* | |
- name: Upload swc artifact | |
uses: actions/upload-artifact@v3 | |
with: | |
name: next-swc-binaries | |
path: packages/next-swc/native/next-swc.*.node | |
- name: Upload turbo summary artifact | |
uses: actions/upload-artifact@v3 | |
with: | |
name: turbo run summary | |
path: .turbo/runs | |
build-wasm: | |
strategy: | |
matrix: | |
target: [web, nodejs] | |
runs-on: macos-latest | |
env: | |
TURBO_TEAM: 'vercel' | |
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }} | |
TURBO_REMOTE_ONLY: 'true' | |
steps: | |
- uses: actions/checkout@v3 | |
- name: Setup node | |
uses: actions/setup-node@v3 | |
with: | |
node-version: ${{ env.NODE_LTS_VERSION }} | |
check-latest: true | |
- run: corepack enable | |
- name: Install Rust | |
uses: ./.github/actions/setup-rust | |
with: | |
targets: wasm32-unknown-unknown | |
- run: npm i -g turbo@${{ env.TURBO_VERSION }} | |
- name: Install wasm-pack | |
run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh | |
- name: normalize versions | |
run: node scripts/normalize-version-bump.js | |
- name: Build | |
run: turbo run build-wasm --remote-cache-timeout 90 --summarize -- --target ${{ matrix.target }} --features tracing/release_max_level_info | |
- name: Add target to folder name | |
run: '[[ -d "packages/next-swc/crates/wasm/pkg" ]] && mv packages/next-swc/crates/wasm/pkg packages/next-swc/crates/wasm/pkg-${{ matrix.target }} || ls packages/next-swc/crates/wasm' | |
- name: Upload turbo summary artifact | |
uses: actions/upload-artifact@v3 | |
with: | |
name: turbo run summary | |
path: .turbo/runs | |
- name: Upload swc artifact | |
uses: actions/upload-artifact@v3 | |
with: | |
name: wasm-binaries | |
path: packages/next-swc/crates/wasm/pkg-* | |
publishRelease: | |
if: ${{ needs.build.outputs.isRelease == 'true' }} | |
name: Potentially publish release | |
runs-on: ubuntu-latest | |
needs: | |
- build | |
- build-wasm | |
- build-native | |
permissions: | |
contents: write | |
id-token: write | |
env: | |
NPM_TOKEN: ${{ secrets.NPM_TOKEN_ELEVATED }} | |
steps: | |
- name: Setup node | |
uses: actions/setup-node@v3 | |
with: | |
node-version: ${{ env.NODE_LTS_VERSION }} | |
check-latest: true | |
- run: corepack enable | |
# https://github.com/actions/virtual-environments/issues/1187 | |
- name: tune linux network | |
run: sudo ethtool -K eth0 tx off rx off | |
- uses: actions/cache@v3 | |
timeout-minutes: 5 | |
id: restore-build | |
with: | |
path: ./* | |
key: ${{ github.sha }}-${{ github.run_number }} | |
- uses: actions/download-artifact@v3 | |
with: | |
name: next-swc-binaries | |
path: packages/next-swc/native | |
- uses: actions/download-artifact@v3 | |
with: | |
name: wasm-binaries | |
path: packages/next-swc/crates/wasm | |
- run: npm i -g [email protected] # need latest version for provenance (pinning to avoid bugs) | |
- run: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc | |
- run: ./scripts/publish-native.js | |
- run: ./scripts/publish-release.js | |
deployExamples: | |
name: Deploy examples | |
runs-on: ubuntu-latest | |
needs: [build] | |
steps: | |
- uses: actions/checkout@v3 | |
with: | |
fetch-depth: 25 | |
- name: Install Vercel CLI | |
run: npm i -g [email protected] | |
- name: Deploy preview examples | |
if: ${{ needs.build.outputs.isRelease != 'true' }} | |
run: ./scripts/deploy-examples.sh | |
env: | |
VERCEL_API_TOKEN: ${{ secrets.VERCEL_API_TOKEN }} | |
DEPLOY_ENVIRONMENT: preview | |
- name: Deploy production examples | |
if: ${{ needs.build.outputs.isRelease == 'true' }} | |
run: ./scripts/deploy-examples.sh | |
env: | |
VERCEL_API_TOKEN: ${{ secrets.VERCEL_API_TOKEN }} | |
DEPLOY_ENVIRONMENT: production | |
testDeployE2E: | |
name: E2E (deploy) | |
runs-on: ubuntu-latest | |
needs: [publishRelease] | |
env: | |
NEXT_TELEMETRY_DISABLED: 1 | |
VERCEL_TEST_TOKEN: ${{ secrets.VERCEL_TEST_TOKEN }} | |
VERCEL_TEST_TEAM: vtest314-next-e2e-tests | |
DATADOG_API_KEY: ${{ secrets.DATA_DOG_API_KEY }} | |
steps: | |
- uses: actions/cache@v3 | |
timeout-minutes: 5 | |
id: restore-build | |
with: | |
path: ./* | |
key: ${{ github.sha }}-${{ github.run_number }} | |
- run: npm i -g vercel@latest | |
- uses: actions/download-artifact@v3 | |
with: | |
name: next-swc-binaries | |
path: packages/next-swc/native | |
- run: RESET_VC_PROJECT=true node scripts/reset-vercel-project.mjs | |
name: Reset test project | |
- run: docker run --rm -v $(pwd):/work mcr.microsoft.com/playwright:v1.35.1-jammy /bin/bash -c "cd /work && NODE_VERSION=${{ env.NODE_LTS_VERSION }} ./scripts/setup-node.sh && corepack enable > /dev/null && DATADOG_TRACE_NEXTJS_TEST=TRUE DATADOG_API_KEY=${DATADOG_API_KEY} DD_ENV=ci VERCEL_TEST_TOKEN=${{ secrets.VERCEL_TEST_TOKEN }} VERCEL_TEST_TEAM=vtest314-next-e2e-tests NEXT_TEST_JOB=1 NEXT_TEST_MODE=deploy TEST_TIMINGS_TOKEN=${{ secrets.TEST_TIMINGS_TOKEN }} NEXT_TEST_CONTINUE_ON_ERROR=1 xvfb-run node run-tests.js --type e2e >> /proc/1/fd/1" | |
name: Run test/e2e (deploy) | |
- name: Upload test trace | |
if: always() | |
uses: actions/upload-artifact@v3 | |
with: | |
name: test-trace | |
if-no-files-found: ignore | |
retention-days: 2 | |
path: | | |
test/traces | |
- name: Upload test trace to datadog | |
continue-on-error: true | |
run: | | |
ls -al ./test | |
npm install -g [email protected] @datadog/[email protected] @aws-sdk/property-provider@3 | |
jrm ./nextjs-test-result-junit.xml "test/test-junit-report/**/*.xml" | |
DD_ENV=ci datadog-ci junit upload --tags test.type:nextjs_deploy_e2e --service nextjs ./nextjs-test-result-junit.xml | |
releaseStats: | |
name: Release Stats | |
runs-on: ubuntu-latest | |
needs: [publishRelease] | |
steps: | |
- name: Setup node | |
uses: actions/setup-node@v3 | |
with: | |
node-version: ${{ env.NODE_LTS_VERSION }} | |
check-latest: true | |
- uses: actions/cache@v3 | |
timeout-minutes: 5 | |
id: restore-build | |
with: | |
path: ./* | |
key: ${{ github.sha }}-${{ github.run_number }} | |
- uses: actions/download-artifact@v3 | |
with: | |
name: next-swc-binaries | |
path: packages/next-swc/native | |
- run: cp -r packages/next-swc/native .github/actions/next-stats-action/native | |
- run: ./scripts/release-stats.sh | |
- uses: ./.github/actions/next-stats-action | |
env: | |
PR_STATS_COMMENT_TOKEN: ${{ secrets.PR_STATS_COMMENT_TOKEN }} | |
upload_turbopack_bytesize: | |
name: Upload Turbopack Bytesize trace to Datadog | |
runs-on: ubuntu-latest | |
needs: [build-native] | |
env: | |
DATADOG_API_KEY: ${{ secrets.DATA_DOG_API_KEY }} | |
steps: | |
- name: Collect bytesize traces | |
uses: actions/download-artifact@v3 | |
with: | |
name: turbopack-bytesize | |
path: turbopack-bin-size | |
- name: Upload to Datadog | |
run: | | |
ls -al turbopack-bin-size | |
npm install -g @datadog/[email protected] @aws-sdk/property-provider@3 | |
for filename in turbopack-bin-size/*; do | |
export BYTESIZE+=" --metrics $(cat $filename)" | |
done | |
echo "Reporting $BYTESIZE" | |
datadog-ci metric --no-fail --level pipeline $BYTESIZE |