Skip to content

fix: examples/with-unsplash/package.json to reduce vulnerabilities #6

fix: examples/with-unsplash/package.json to reduce vulnerabilities

fix: examples/with-unsplash/package.json to reduce vulnerabilities #6

name: build-and-deploy
on:
push:
branches: ['canary']
workflow_dispatch:
env:
NAPI_CLI_VERSION: 2.14.7
TURBO_VERSION: 1.10.9
NODE_MAINTENANCE_VERSION: 16
NODE_LTS_VERSION: 18.16.1
CARGO_PROFILE_RELEASE_LTO: 'true'
jobs:
build:
runs-on: ubuntu-latest
env:
NEXT_TELEMETRY_DISABLED: 1
# we build a dev binary for use in CI so skip downloading
# canary next-swc binaries in the monorepo
NEXT_SKIP_NATIVE_POSTINSTALL: 1
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
outputs:
isRelease: ${{ github.event_name != 'workflow_dispatch' && steps.check-release.outputs.IS_RELEASE }}
steps:
- name: Setup node
uses: actions/setup-node@v3
with:
node-version: ${{ env.NODE_LTS_VERSION }}
check-latest: true
- run: corepack enable
- uses: actions/checkout@v3
with:
fetch-depth: 25
- id: get-store-path
run: echo STORE_PATH=$(pnpm store path) >> $GITHUB_OUTPUT
- uses: actions/cache@v3
timeout-minutes: 5
id: cache-pnpm-store
with:
path: ${{ steps.get-store-path.outputs.STORE_PATH }}
key: pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
restore-keys: |
pnpm-store-
pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
- run: pnpm install
- run: pnpm run build
- id: check-release
run: |
if [[ $(node ./scripts/check-is-release.js 2> /dev/null || :) = v* ]];
then
echo "IS_RELEASE=true" >> $GITHUB_OUTPUT
else
echo "IS_RELEASE=false" >> $GITHUB_OUTPUT
fi
- uses: actions/cache@v3
timeout-minutes: 5
id: cache-build
with:
path: ./*
key: ${{ github.sha }}-${{ github.run_number }}
# Build binaries for publishing
build-native:
strategy:
fail-fast: false
matrix:
settings:
# pnpm is aliased here temporarily until the build docker
# image is updated past Node.js v14.19 (current 14.18.1)
- host: macos-latest
target: 'x86_64-apple-darwin'
build: |
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target x86_64-apple-darwin --release
strip -x packages/next-swc/native/next-swc.*.node
- host: windows-latest
build: |
corepack enable
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}"
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target x86_64-pc-windows-msvc
target: 'x86_64-pc-windows-msvc'
- host: windows-latest
build: |
corepack enable
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}"
turbo run build-native-no-plugin --remote-cache-timeout 90 --summarize -- --release --target i686-pc-windows-msvc
target: 'i686-pc-windows-msvc'
- host: ubuntu-latest
target: 'x86_64-unknown-linux-gnu'
docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:stable-2022-10-24-x64
build: >-
set -e &&
apt update &&
apt install -y pkg-config &&
rustup toolchain install "${RUST_TOOLCHAIN}" &&
rustup default "${RUST_TOOLCHAIN}" &&
rustup target add x86_64-unknown-linux-gnu &&
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi &&
unset CC_x86_64_unknown_linux_gnu && unset CC &&
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target x86_64-unknown-linux-gnu &&
strip packages/next-swc/native/next-swc.*.node
- host: ubuntu-latest
target: 'x86_64-unknown-linux-musl'
docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:stable-2022-10-24-alpine
build: >-
set -e &&
apk add --no-cache libc6-compat pkgconfig &&
rustup toolchain install "${RUST_TOOLCHAIN}" &&
rustup default "${RUST_TOOLCHAIN}" &&
rustup target add x86_64-unknown-linux-musl &&
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi &&
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target x86_64-unknown-linux-musl &&
strip packages/next-swc/native/next-swc.*.node
- host: macos-latest
target: 'aarch64-apple-darwin'
build: |
sudo rm -Rf /Library/Developer/CommandLineTools/SDKs/*;
export CC=$(xcrun -f clang);
export CXX=$(xcrun -f clang++);
SYSROOT=$(xcrun --sdk macosx --show-sdk-path);
export CFLAGS="-isysroot $SYSROOT -isystem $SYSROOT";
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target aarch64-apple-darwin
strip -x packages/next-swc/native/next-swc.*.node
- host: ubuntu-latest
target: 'aarch64-unknown-linux-gnu'
docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:stable-2022-10-24-aarch64
build: >-
set -e &&
apt update &&
apt install -y pkg-config &&
export JEMALLOC_SYS_WITH_LG_PAGE=16 &&
rustup toolchain install "${RUST_TOOLCHAIN}" &&
rustup default "${RUST_TOOLCHAIN}" &&
rustup target add aarch64-unknown-linux-gnu &&
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi &&
export CC_aarch64_unknown_linux_gnu=/usr/aarch64-unknown-linux-gnu/bin/aarch64-unknown-linux-gnu-gcc &&
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target aarch64-unknown-linux-gnu --features plugin,rustls-tls,tracing/release_max_level_info &&
llvm-strip -x packages/next-swc/native/next-swc.*.node
- host: ubuntu-latest
target: 'aarch64-unknown-linux-musl'
docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:stable-2022-10-24-alpine
build: >-
set -e &&
apk add --no-cache libc6-compat pkgconfig &&
export JEMALLOC_SYS_WITH_LG_PAGE=16 &&
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}" && if [ ! -f $(dirname $(which yarn))/pnpm ]; then ln -s $(which yarn) $(dirname $(which yarn))/pnpm;fi &&
rustup toolchain install "${RUST_TOOLCHAIN}" &&
rustup default "${RUST_TOOLCHAIN}" &&
rustup target add aarch64-unknown-linux-musl &&
turbo run build-native-release --remote-cache-timeout 90 --summarize -- --target aarch64-unknown-linux-musl &&
llvm-strip -x packages/next-swc/native/next-swc.*.node
- host: windows-latest
target: 'aarch64-pc-windows-msvc'
build: |
corepack enable
npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}" "turbo@${TURBO_VERSION}"
turbo run build-native-no-plugin-woa-release --remote-cache-timeout 90 --summarize -- --target aarch64-pc-windows-msvc
name: stable - ${{ matrix.settings.target }} - node@16
runs-on: ${{ matrix.settings.host }}
env:
TURBO_TEAM: 'vercel'
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
TURBO_REMOTE_ONLY: 'true'
steps:
# https://github.com/actions/virtual-environments/issues/1187
- name: tune linux network
run: sudo ethtool -K eth0 tx off rx off
if: ${{ matrix.settings.host == 'ubuntu-latest' }}
- name: tune linux network
run: sudo ethtool -K eth0 tx off rx off
if: ${{ matrix.settings.host == 'ubuntu-latest' }}
- name: tune windows network
run: Disable-NetAdapterChecksumOffload -Name * -TcpIPv4 -UdpIPv4 -TcpIPv6 -UdpIPv6
if: ${{ matrix.settings.host == 'windows-latest' }}
- name: tune mac network
run: sudo sysctl -w net.link.generic.system.hwcksum_tx=0 && sudo sysctl -w net.link.generic.system.hwcksum_rx=0
if: ${{ matrix.settings.host == 'macos-latest' }}
# we use checkout here instead of the build cache since
# it can fail to restore in different OS'
- uses: actions/checkout@v3
- name: Setup node
uses: actions/setup-node@v3
if: ${{ !matrix.settings.docker }}
with:
node-version: ${{ env.NODE_LTS_VERSION }}
check-latest: true
- name: Install Rust
uses: ./.github/actions/setup-rust
with:
targets: ${{ matrix.settings.target }}
skip-install: ${{ matrix.settings.docker }}
- name: Cache cargo registry
uses: actions/cache@v3
timeout-minutes: 5
with:
path: ~/.cargo/registry
key: ${{ matrix.settings.target }}-cargo-registry
- name: Cache cargo index
uses: actions/cache@v3
timeout-minutes: 5
with:
path: ~/.cargo/git
key: ${{ matrix.settings.target }}-cargo-index
- name: normalize versions
run: node scripts/normalize-version-bump.js
- name: Setup toolchain
run: ${{ matrix.settings.setup }}
if: ${{ matrix.settings.setup }}
shell: bash
- name: Build in docker
uses: addnab/docker-run-action@v3
if: ${{ matrix.settings.docker }}
with:
image: ${{ matrix.settings.docker }}
options: >-
-e RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}
-e CARGO_INCREMENTAL=${{ env.CARGO_INCREMENTAL }}
-e CARGO_PROFILE_RELEASE_LTO=${{ env.CARGO_PROFILE_RELEASE_LTO }}
-e CARGO_TERM_COLOR=${{ env.CARGO_TERM_COLOR }}
-e RUST_BACKTRACE=${{ env.RUST_BACKTRACE }}
-e CARGO_REGISTRIES_CRATES_IO_PROTOCOL=${{ env.CARGO_REGISTRIES_CRATES_IO_PROTOCOL }}
-e NAPI_CLI_VERSION=${{ env.NAPI_CLI_VERSION }}
-e TURBO_VERSION=${{ env.TURBO_VERSION }}
-e TURBO_TEAM=vercel
-e TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
-e TURBO_REMOTE_ONLY=true
-v ${{ env.HOME }}/.cargo/git:/root/.cargo/git
-v ${{ env.HOME }}/.cargo/registry:/root/.cargo/registry
-v ${{ github.workspace }}:/build
-w /build
run: ${{ matrix.settings.build }}
- name: 'Build'
run: ${{ matrix.settings.build }}
if: ${{ !matrix.settings.docker }}
shell: bash
- name: 'check build cache status'
id: check-did-build
shell: bash
run: if [[ ! -z $(ls .turbo/runs) ]]; then echo "DID_BUILD=yup" >> $GITHUB_OUTPUT; fi
# Trying to upload metrics for the Turbopack to datadog's CI pipeline execution
- name: 'Collect turbopack build metrics'
id: check-turbopack-bytesize
shell: bash
if: ${{ steps.check-did-build.outputs.DID_BUILD == 'yup' }}
continue-on-error: true
run: |
mkdir -p ./turbopack-bin-size
shopt -s nullglob
for filename in packages/next-swc/native/next-swc.*.node; do
# Strip out filename to extract target triple
export FILENAME=$(basename ${filename})
export FILENAME=${FILENAME#*.}
export FILENAME=${FILENAME%.node}
export BYTESIZE=$(wc -c < $filename | xargs)
echo "Reporting $FILENAME:$BYTESIZE for Turbopack bytesize"
echo "turbopack.bytesize.$FILENAME:$BYTESIZE" > ./turbopack-bin-size/${{ matrix.settings.target }}
done
- name: Upload turbopack bytesize artifact
if: ${{ steps.check-did-build.outputs.DID_BUILD == 'yup' }}
uses: actions/upload-artifact@v3
with:
name: turbopack-bytesize
path: turbopack-bin-size/*
- name: Upload swc artifact
uses: actions/upload-artifact@v3
with:
name: next-swc-binaries
path: packages/next-swc/native/next-swc.*.node
- name: Upload turbo summary artifact
uses: actions/upload-artifact@v3
with:
name: turbo run summary
path: .turbo/runs
build-wasm:
strategy:
matrix:
target: [web, nodejs]
runs-on: macos-latest
env:
TURBO_TEAM: 'vercel'
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
TURBO_REMOTE_ONLY: 'true'
steps:
- uses: actions/checkout@v3
- name: Setup node
uses: actions/setup-node@v3
with:
node-version: ${{ env.NODE_LTS_VERSION }}
check-latest: true
- run: corepack enable
- name: Install Rust
uses: ./.github/actions/setup-rust
with:
targets: wasm32-unknown-unknown
- run: npm i -g turbo@${{ env.TURBO_VERSION }}
- name: Install wasm-pack
run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
- name: normalize versions
run: node scripts/normalize-version-bump.js
- name: Build
run: turbo run build-wasm --remote-cache-timeout 90 --summarize -- --target ${{ matrix.target }} --features tracing/release_max_level_info
- name: Add target to folder name
run: '[[ -d "packages/next-swc/crates/wasm/pkg" ]] && mv packages/next-swc/crates/wasm/pkg packages/next-swc/crates/wasm/pkg-${{ matrix.target }} || ls packages/next-swc/crates/wasm'
- name: Upload turbo summary artifact
uses: actions/upload-artifact@v3
with:
name: turbo run summary
path: .turbo/runs
- name: Upload swc artifact
uses: actions/upload-artifact@v3
with:
name: wasm-binaries
path: packages/next-swc/crates/wasm/pkg-*
publishRelease:
if: ${{ needs.build.outputs.isRelease == 'true' }}
name: Potentially publish release
runs-on: ubuntu-latest
needs:
- build
- build-wasm
- build-native
permissions:
contents: write
id-token: write
env:
NPM_TOKEN: ${{ secrets.NPM_TOKEN_ELEVATED }}
steps:
- name: Setup node
uses: actions/setup-node@v3
with:
node-version: ${{ env.NODE_LTS_VERSION }}
check-latest: true
- run: corepack enable
# https://github.com/actions/virtual-environments/issues/1187
- name: tune linux network
run: sudo ethtool -K eth0 tx off rx off
- uses: actions/cache@v3
timeout-minutes: 5
id: restore-build
with:
path: ./*
key: ${{ github.sha }}-${{ github.run_number }}
- uses: actions/download-artifact@v3
with:
name: next-swc-binaries
path: packages/next-swc/native
- uses: actions/download-artifact@v3
with:
name: wasm-binaries
path: packages/next-swc/crates/wasm
- run: npm i -g [email protected] # need latest version for provenance (pinning to avoid bugs)
- run: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
- run: ./scripts/publish-native.js
- run: ./scripts/publish-release.js
deployExamples:
name: Deploy examples
runs-on: ubuntu-latest
needs: [build]
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 25
- name: Install Vercel CLI
run: npm i -g [email protected]
- name: Deploy preview examples
if: ${{ needs.build.outputs.isRelease != 'true' }}
run: ./scripts/deploy-examples.sh
env:
VERCEL_API_TOKEN: ${{ secrets.VERCEL_API_TOKEN }}
DEPLOY_ENVIRONMENT: preview
- name: Deploy production examples
if: ${{ needs.build.outputs.isRelease == 'true' }}
run: ./scripts/deploy-examples.sh
env:
VERCEL_API_TOKEN: ${{ secrets.VERCEL_API_TOKEN }}
DEPLOY_ENVIRONMENT: production
testDeployE2E:
name: E2E (deploy)
runs-on: ubuntu-latest
needs: [publishRelease]
env:
NEXT_TELEMETRY_DISABLED: 1
VERCEL_TEST_TOKEN: ${{ secrets.VERCEL_TEST_TOKEN }}
VERCEL_TEST_TEAM: vtest314-next-e2e-tests
DATADOG_API_KEY: ${{ secrets.DATA_DOG_API_KEY }}
steps:
- uses: actions/cache@v3
timeout-minutes: 5
id: restore-build
with:
path: ./*
key: ${{ github.sha }}-${{ github.run_number }}
- run: npm i -g vercel@latest
- uses: actions/download-artifact@v3
with:
name: next-swc-binaries
path: packages/next-swc/native
- run: RESET_VC_PROJECT=true node scripts/reset-vercel-project.mjs
name: Reset test project
- run: docker run --rm -v $(pwd):/work mcr.microsoft.com/playwright:v1.35.1-jammy /bin/bash -c "cd /work && NODE_VERSION=${{ env.NODE_LTS_VERSION }} ./scripts/setup-node.sh && corepack enable > /dev/null && DATADOG_TRACE_NEXTJS_TEST=TRUE DATADOG_API_KEY=${DATADOG_API_KEY} DD_ENV=ci VERCEL_TEST_TOKEN=${{ secrets.VERCEL_TEST_TOKEN }} VERCEL_TEST_TEAM=vtest314-next-e2e-tests NEXT_TEST_JOB=1 NEXT_TEST_MODE=deploy TEST_TIMINGS_TOKEN=${{ secrets.TEST_TIMINGS_TOKEN }} NEXT_TEST_CONTINUE_ON_ERROR=1 xvfb-run node run-tests.js --type e2e >> /proc/1/fd/1"
name: Run test/e2e (deploy)
- name: Upload test trace
if: always()
uses: actions/upload-artifact@v3
with:
name: test-trace
if-no-files-found: ignore
retention-days: 2
path: |
test/traces
- name: Upload test trace to datadog
continue-on-error: true
run: |
ls -al ./test
npm install -g [email protected] @datadog/[email protected] @aws-sdk/property-provider@3
jrm ./nextjs-test-result-junit.xml "test/test-junit-report/**/*.xml"
DD_ENV=ci datadog-ci junit upload --tags test.type:nextjs_deploy_e2e --service nextjs ./nextjs-test-result-junit.xml
releaseStats:
name: Release Stats
runs-on: ubuntu-latest
needs: [publishRelease]
steps:
- name: Setup node
uses: actions/setup-node@v3
with:
node-version: ${{ env.NODE_LTS_VERSION }}
check-latest: true
- uses: actions/cache@v3
timeout-minutes: 5
id: restore-build
with:
path: ./*
key: ${{ github.sha }}-${{ github.run_number }}
- uses: actions/download-artifact@v3
with:
name: next-swc-binaries
path: packages/next-swc/native
- run: cp -r packages/next-swc/native .github/actions/next-stats-action/native
- run: ./scripts/release-stats.sh
- uses: ./.github/actions/next-stats-action
env:
PR_STATS_COMMENT_TOKEN: ${{ secrets.PR_STATS_COMMENT_TOKEN }}
upload_turbopack_bytesize:
name: Upload Turbopack Bytesize trace to Datadog
runs-on: ubuntu-latest
needs: [build-native]
env:
DATADOG_API_KEY: ${{ secrets.DATA_DOG_API_KEY }}
steps:
- name: Collect bytesize traces
uses: actions/download-artifact@v3
with:
name: turbopack-bytesize
path: turbopack-bin-size
- name: Upload to Datadog
run: |
ls -al turbopack-bin-size
npm install -g @datadog/[email protected] @aws-sdk/property-provider@3
for filename in turbopack-bin-size/*; do
export BYTESIZE+=" --metrics $(cat $filename)"
done
echo "Reporting $BYTESIZE"
datadog-ci metric --no-fail --level pipeline $BYTESIZE