Skip to content

Conversation

@sohelshekhIn
Copy link
Member

@sohelshekhIn sohelshekhIn commented Oct 28, 2025

This workflow triggers on pull request events and checks the status of the latest Vercel deployment. If the deployment fails, it fetches error logs and posts a comment on the PR with the relevant error details.

Summary by CodeRabbit

  • Chores
    • Added an automated workflow that posts diagnostic comments on pull requests when deployments fail: it detects matching deployments, extracts concise error snippets (up to 20 lines), includes a failure notice and a link to full deployment logs, and skips commenting if no relevant deployment is found.

… PRs

This workflow triggers on pull request events and checks the status of the latest Vercel deployment. If the deployment fails, it fetches error logs and posts a comment on the PR with the relevant error details.
Copilot AI review requested due to automatic review settings October 28, 2025 22:28
@vercel
Copy link

vercel bot commented Oct 28, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
daedalus-hacker-portal Error Error Oct 28, 2025 10:52pm

@coderabbitai
Copy link

coderabbitai bot commented Oct 28, 2025

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

A new GitHub Actions workflow is added that runs on PR open/synchronize/reopen, finds the latest Vercel deployment for the PR branch, and if the deployment state is ERROR, extracts error lines from deployment events and posts a comment on the PR with the errors and a link to full logs. (47 words)

Changes

Cohort / File(s) Summary
New GitHub Actions workflow
.github/workflows/vercel-fail-comment.yml
Adds a workflow triggered on PR events (opened, synchronize, reopened). It locates the latest Vercel deployment for the PR branch, checks its state, fetches deployment events when state is ERROR, extracts up to 20 error-related lines, and posts a PR comment with those lines and a link to full logs.

Sequence Diagram

sequenceDiagram
    actor GitHub as GitHub
    participant WF as vercel-fail-comment.yml
    participant Vercel as Vercel API
    participant GH_API as GitHub REST API

    GitHub->>WF: PR event (opened / synchronize / reopened)
    WF->>WF: Read PR branch, SHA, number
    WF->>Vercel: GET /v6/deployments?project=...&limit=... 
    Vercel-->>WF: deployments list
    WF->>WF: Find latest deployment where gitBranch == PR branch

    alt deployment found
        WF->>Vercel: GET deployment state
        Vercel-->>WF: deployment state
        alt state == ERROR
            WF->>Vercel: GET deployment events/logs
            Vercel-->>WF: event logs
            WF->>WF: Extract ≤20 error lines (Error/Exception/Failed)
            WF->>GH_API: POST /repos/.../issues/{pr}/comments (comment with errors + link)
            GH_API-->>GitHub: Comment posted
        else
            WF->>WF: No action (not an error)
        end
    else
        WF->>WF: Exit (no matching deployment)
    end
Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

  • Inspect API calls and query parameters used to select deployments by branch.
  • Verify error-line extraction (matching keywords, truncation to 20 lines).
  • Confirm correct use of secrets (Vercel token, GITHUB_TOKEN) and GitHub comment payload formatting.

Poem

🐇 I hopped through logs at break of day,
Found errors where the builds went astray.
I nibble lines and leave a clue,
A friendly note to help you through.
Hooray—deployments mend, hip-hop-hooray!

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check ✅ Passed The PR title "Add GitHub Actions workflow to comment on Vercel deployment errors in PRs" accurately and directly describes the main change being introduced. The changeset adds a new GitHub Actions workflow file that monitors Vercel deployments and posts comments on pull requests when deployment errors occur. The title is concise, specific, and avoids vague language while maintaining clarity about what functionality is being added. A developer scanning the repository history would immediately understand that this PR introduces automation for notifying contributors of Vercel deployment failures.
✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch comment-vercel-error-stack-in-github

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds a GitHub Actions workflow that automatically monitors Vercel deployments for pull requests and posts error details as PR comments when deployments fail.

  • Adds automated monitoring of Vercel deployment status for PRs
  • Implements error log extraction and formatting for failed deployments
  • Provides direct links to full Vercel logs for debugging

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +85 to +86
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Copy link

Copilot AI Oct 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The environment variable declaration is misplaced. It should be moved inside the step that uses it (line 56-83) rather than being a separate block at the end.

Copilot uses AI. Check for mistakes.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot open a new pull request to apply changes based on this feedback

"https://api.vercel.com/v2/deployments/$DEPLOYMENT_ID/events")

# Extract only build errors
error_lines=$(echo "$logs" | jq -r '.[] | select(.payload.text | test("Error|Exception|Failed"; "i")) | .payload.text' | tail -n 20)
Copy link

Copilot AI Oct 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex pattern 'Error|Exception|Failed' may be too broad and could capture unrelated log entries. Consider using more specific patterns or filtering by log level/type if available in the Vercel API response.

Suggested change
error_lines=$(echo "$logs" | jq -r '.[] | select(.payload.text | test("Error|Exception|Failed"; "i")) | .payload.text' | tail -n 20)
# Prefer filtering by log type if available, else use a more specific regex
if echo "$logs" | jq -e '.[0] | has("type")' > /dev/null 2>&1; then
error_lines=$(echo "$logs" | jq -r '.[] | select(.type == "error") | .payload.text' | tail -n 20)
else
error_lines=$(echo "$logs" | jq -r '.[] | select(.payload.text | test("\\b(Error|Exception|Failed)\\b"; "i")) | .payload.text' | tail -n 20)
fi

Copilot uses AI. Check for mistakes.
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (1)
.github/workflows/vercel-fail-comment.yml (1)

68-68: Consider edge cases in regex-based log extraction.

Line 68 uses a regex filter to extract error lines. If the log format changes or contains unexpected text, the regex may fail silently or extract irrelevant lines. The fallback message (line 71) is helpful, but consider:

  1. Adding bounds checking: ensure tail -n 20 doesn't return empty when logs exist but don't match the regex.
  2. Logging the raw response count to aid debugging.
  3. Testing with real Vercel failure scenarios.
📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c65ca5c and 2c74f5a.

📒 Files selected for processing (1)
  • .github/workflows/vercel-fail-comment.yml (1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.8)
.github/workflows/vercel-fail-comment.yml

13-13: "github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details

(expression)


85-85: key "env" is duplicated in element of "steps" section. previously defined at line:58,col:9

(syntax-check)

🪛 YAMLlint (1.37.1)
.github/workflows/vercel-fail-comment.yml

[error] 85-85: duplication of key "env" in mapping

(key-duplicates)

🔇 Additional comments (2)
.github/workflows/vercel-fail-comment.yml (2)

14-14: Escape github.head_ref to mitigate script injection risk.

While the workflow correctly passes github.head_ref through jq --arg (which is safe), actionlint flags the initial extraction at line 14 as a potential injection vector. Following GitHub's security guidance, add quoting and use set -x or alternative protection:

  - name: Get PR info
    run: |
      echo "PR_BRANCH=${{ github.head_ref }}" >> $GITHUB_ENV
      echo "PR_SHA=${{ github.event.pull_request.head.sha }}" >> $GITHUB_ENV
      echo "PR_NUMBER=${{ github.event.pull_request.number }}" >> $GITHUB_ENV

Consider this safer alternative with explicit quoting:

  - name: Get PR info
    run: |
      echo "PR_BRANCH=$(printf '%s\n' "${{ github.head_ref }}")" >> $GITHUB_ENV
      echo "PR_SHA=$(printf '%s\n' "${{ github.event.pull_request.head.sha }}")" >> $GITHUB_ENV
      echo "PR_NUMBER=$(printf '%s\n' "${{ github.event.pull_request.number }}")" >> $GITHUB_ENV

27-27: I need to check the actual Vercel API documentation to verify the response schema compatibility between v6 and v13 endpoints.

I need to search for more specific information about what these two endpoints actually do and whether they serve different purposes.

Vercel API versions serve different purposes and are compatible by design.

The review comment flags an apparent inconsistency, but v6 /deployments is used for listing deployments, while v13 /deployments is used for getting deployment details. These are intentionally different versioned endpoints for different operations. The v6 list endpoint returns deployments with state and other fields, and both endpoints include compatible response structures. Using different API versions for different operations is a supported practice per Vercel's API design. No changes are required.

Comment on lines +24 to +27
run: |
echo "Fetching latest deployment for branch $PR_BRANCH"
response=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
"https://api.vercel.com/v6/deployments?projectId=$VERCEL_PROJECT_ID&limit=5")
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add error handling for curl commands.

The workflow uses curl -s (silent mode) without checking for HTTP errors or network failures. If any API call fails, the script will silently continue with empty/invalid responses, producing unclear errors or no comment at all.

Add error checking after each curl call:

  - name: Get latest Vercel deployment for this PR
    id: get-deploy
    env:
      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
      VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
      PR_BRANCH: ${{ env.PR_BRANCH }}
    run: |
      echo "Fetching latest deployment for branch $PR_BRANCH"
      response=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
        "https://api.vercel.com/v6/deployments?projectId=$VERCEL_PROJECT_ID&limit=5")

+     # Check for curl errors
+     if [ -z "$response" ]; then
+       echo "Failed to fetch deployments from Vercel API"
+       echo "found=false" >> $GITHUB_OUTPUT
+       exit 0
+     fi

Apply similar error checks to lines 50 (status check) and 64 (fetch logs). Consider using curl -f to fail on HTTP errors and -H "Accept: application/json" for robustness.

Also applies to: 50-50, 64-64

🤖 Prompt for AI Agents
.github/workflows/vercel-fail-comment.yml lines 24-27 (and similarly at lines 50
and 64): the curl calls are run in silent mode without failing on HTTP errors or
validating responses; update each curl invocation to include -f and -H "Accept:
application/json", then immediately check curl's exit status and verify the
response is non-empty/valid JSON (exit with failure or echo a clear error
message when checks fail) so the workflow stops or reports a clear failure
instead of continuing with empty/invalid data.

Comment on lines +58 to +86
env:
VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
DEPLOYMENT_ID: ${{ env.DEPLOYMENT_ID }}
PR_NUMBER: ${{ env.PR_NUMBER }}
run: |
echo "Deployment failed. Fetching logs..."
logs=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
"https://api.vercel.com/v2/deployments/$DEPLOYMENT_ID/events")

# Extract only build errors
error_lines=$(echo "$logs" | jq -r '.[] | select(.payload.text | test("Error|Exception|Failed"; "i")) | .payload.text' | tail -n 20)

if [ -z "$error_lines" ]; then
error_lines="No specific error lines found. Check full logs on Vercel."
fi

# Post comment on PR
gh api repos/${{ github.repository }}/issues/$PR_NUMBER/comments \
-f body="❌ **Vercel Deployment Failed**

**Error stack:**
\`\`\`
$error_lines
\`\`\`
[View full logs on Vercel →](https://vercel.com/dashboard/deployments/$DEPLOYMENT_ID)
"

env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical: Fix duplicate env key causing secrets to be unavailable.

The step has two env sections at lines 58–61 and 85–86. In YAML, the second env key will override the first, making VERCEL_TOKEN, DEPLOYMENT_ID, and PR_NUMBER unavailable to the shell script. This will cause the curl and gh commands to fail at runtime.

Merge both env blocks into a single section:

      - name: Fetch and comment error logs if deployment failed
        if: steps.check-status.outputs.status == 'ERROR'
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
          DEPLOYMENT_ID: ${{ env.DEPLOYMENT_ID }}
          PR_NUMBER: ${{ env.PR_NUMBER }}
+         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Deployment failed. Fetching logs..."
          logs=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
            "https://api.vercel.com/v2/deployments/$DEPLOYMENT_ID/events")

          # Extract only build errors
          error_lines=$(echo "$logs" | jq -r '.[] | select(.payload.text | test("Error|Exception|Failed"; "i")) | .payload.text' | tail -n 20)

          if [ -z "$error_lines" ]; then
            error_lines="No specific error lines found. Check full logs on Vercel."
          fi

          # Post comment on PR
          gh api repos/${{ github.repository }}/issues/$PR_NUMBER/comments \
            -f body="❌ **Vercel Deployment Failed**

          **Error stack:**
          \`\`\`
          $error_lines
          \`\`\`
          [View full logs on Vercel →](https://vercel.com/dashboard/deployments/$DEPLOYMENT_ID)
          "
-
-       env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
env:
VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
DEPLOYMENT_ID: ${{ env.DEPLOYMENT_ID }}
PR_NUMBER: ${{ env.PR_NUMBER }}
run: |
echo "Deployment failed. Fetching logs..."
logs=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
"https://api.vercel.com/v2/deployments/$DEPLOYMENT_ID/events")
# Extract only build errors
error_lines=$(echo "$logs" | jq -r '.[] | select(.payload.text | test("Error|Exception|Failed"; "i")) | .payload.text' | tail -n 20)
if [ -z "$error_lines" ]; then
error_lines="No specific error lines found. Check full logs on Vercel."
fi
# Post comment on PR
gh api repos/${{ github.repository }}/issues/$PR_NUMBER/comments \
-f body="❌ **Vercel Deployment Failed**
**Error stack:**
\`\`\`
$error_lines
\`\`\`
[View full logs on Vercel →](https://vercel.com/dashboard/deployments/$DEPLOYMENT_ID)
"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
env:
VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
DEPLOYMENT_ID: ${{ env.DEPLOYMENT_ID }}
PR_NUMBER: ${{ env.PR_NUMBER }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
echo "Deployment failed. Fetching logs..."
logs=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
"https://api.vercel.com/v2/deployments/$DEPLOYMENT_ID/events")
# Extract only build errors
error_lines=$(echo "$logs" | jq -r '.[] | select(.payload.text | test("Error|Exception|Failed"; "i")) | .payload.text' | tail -n 20)
if [ -z "$error_lines" ]; then
error_lines="No specific error lines found. Check full logs on Vercel."
fi
# Post comment on PR
gh api repos/${{ github.repository }}/issues/$PR_NUMBER/comments \
-f body="❌ **Vercel Deployment Failed**
**Error stack:**
\`\`\`
$error_lines
\`\`\`
[View full logs on Vercel →](https://vercel.com/dashboard/deployments/$DEPLOYMENT_ID)
"
🧰 Tools
🪛 actionlint (1.7.8)

85-85: key "env" is duplicated in element of "steps" section. previously defined at line:58,col:9

(syntax-check)

🪛 YAMLlint (1.37.1)

[error] 85-85: duplication of key "env" in mapping

(key-duplicates)

🤖 Prompt for AI Agents
.github/workflows/vercel-fail-comment.yml around lines 58 to 86: the step
defines two separate env blocks which causes the latter to override the former
and make VERCEL_TOKEN, DEPLOYMENT_ID and PR_NUMBER unavailable; fix by merging
both env sections into a single env block for that run step that includes
VERCEL_TOKEN, DEPLOYMENT_ID, PR_NUMBER and GITHUB_TOKEN (preserving the secret
and env references), remove the duplicate env key, and keep the script unchanged
so curl and gh commands can access the variables at runtime.

Copy link

Copilot AI commented Oct 28, 2025

@sohelshekhIn I've opened a new pull request, #3, to work on those changes. Once the pull request is ready, I'll request review from you.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

♻️ Duplicate comments (1)
.github/workflows/vercel-fail-comment.yml (1)

85-86: Fix duplicate env key—this breaks the workflow at runtime.

The step defines two separate env blocks (lines 58–61 and 85–86). In YAML, the second env key overrides the first, making VERCEL_TOKEN, DEPLOYMENT_ID, and PR_NUMBER unavailable to the curl and gh commands. This will cause the workflow to fail.

Merge both env blocks into one:

      - name: Fetch and comment error logs if deployment failed
        if: steps.check-status.outputs.status == 'ERROR'
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
          DEPLOYMENT_ID: ${{ env.DEPLOYMENT_ID }}
          PR_NUMBER: ${{ env.PR_NUMBER }}
+         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Deployment failed. Fetching logs..."
          logs=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
            "https://api.vercel.com/v2/deployments/$DEPLOYMENT_ID/events")

          # Extract only build errors
          error_lines=$(echo "$logs" | jq -r '.[] | select(.payload.text | test("Error|Exception|Failed"; "i")) | .payload.text' | tail -n 20)

          if [ -z "$error_lines" ]; then
            error_lines="No specific error lines found. Check full logs on Vercel."
          fi

          # Post comment on PR
          gh api repos/${{ github.repository }}/issues/$PR_NUMBER/comments \
            -f body="❌ **Vercel Deployment Failed**

          **Error stack:**
          \`\`\`
          $error_lines
          \`\`\`
          [View full logs on Vercel →](https://vercel.com/dashboard/deployments/$DEPLOYMENT_ID)
          "
🧹 Nitpick comments (1)
.github/workflows/vercel-fail-comment.yml (1)

30-31: Add null/missing-field check for jq filter.

The jq filter assumes .meta.gitBranch exists, but this field may not be present in all deployment responses. Without a null check, the selection could fail silently or filter out valid deployments.

Use the optional object identifier (.meta.gitBranch?) to safely access potentially missing fields:

          # Find the most recent deployment for this PR branch
          DEPLOYMENT_ID=$(echo "$response" | jq -r --arg branch "$PR_BRANCH" \
-           '.deployments[] | select(.meta.gitBranch? == $branch) | .uid' | head -n1)
+           '.deployments[] | select(.meta.gitBranch? == $branch or .url? | test($branch)) | .uid' | head -n1)

(The alternate condition .url? | test($branch) provides a fallback if .meta.gitBranch is absent.)

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2c74f5a and 7fe08b4.

📒 Files selected for processing (1)
  • .github/workflows/vercel-fail-comment.yml (1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.8)
.github/workflows/vercel-fail-comment.yml

13-13: "github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details

(expression)


85-85: key "env" is duplicated in element of "steps" section. previously defined at line:58,col:9

(syntax-check)

🪛 YAMLlint (1.37.1)
.github/workflows/vercel-fail-comment.yml

[error] 85-85: duplication of key "env" in mapping

(key-duplicates)

Comment on lines +13 to +16
run: |
echo "PR_BRANCH=${{ github.head_ref }}" >> $GITHUB_ENV
echo "PR_SHA=${{ github.event.pull_request.head.sha }}" >> $GITHUB_ENV
echo "PR_NUMBER=${{ github.event.pull_request.number }}" >> $GITHUB_ENV
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Secure untrusted context by passing it through environment variables.

Line 13 uses github.head_ref directly in an inline script, which poses a script-injection risk. Although github.head_ref is only populated for fork pull requests (a lower-risk scenario), it's a best practice to pass potentially untrusted values through environment variables for defense-in-depth.

      - name: Get PR info
        run: |
+         PR_BRANCH="${{ github.head_ref }}"
+         if [ -z "$PR_BRANCH" ]; then
+           PR_BRANCH="${{ github.ref_name }}"
+         fi
-         echo "PR_BRANCH=${{ github.head_ref }}" >> $GITHUB_ENV
+         echo "PR_BRANCH=$PR_BRANCH" >> $GITHUB_ENV
          echo "PR_SHA=${{ github.event.pull_request.head.sha }}" >> $GITHUB_ENV
          echo "PR_NUMBER=${{ github.event.pull_request.number }}" >> $GITHUB_ENV
🧰 Tools
🪛 actionlint (1.7.8)

13-13: "github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details

(expression)

🤖 Prompt for AI Agents
.github/workflows/vercel-fail-comment.yml lines 13-16: the workflow currently
injects GitHub context values directly inside the inline run script which can
expose untrusted input to shell interpolation; instead declare PR_BRANCH, PR_SHA
and PR_NUMBER in an env: block at the step or job level using the GitHub context
(e.g. env: PR_BRANCH: ${{ github.head_ref }}, etc.), then reference those
environment variables inside the run script (e.g. use $PR_BRANCH, $PR_SHA,
$PR_NUMBER) so the runner receives values via the environment rather than
evaluating expressions directly in the shell.

Comment on lines +26 to +27
response=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
"https://api.vercel.com/v6/deployments?projectId=$VERCEL_PROJECT_ID&limit=5")
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add error handling to all curl commands.

The three curl calls lack error handling. If any API call fails (network error, invalid credentials, etc.), the script silently continues with empty or invalid responses, producing unclear errors or missing comments.

Add -f (fail on HTTP errors), check the exit status, and validate responses are non-empty:

      - name: Get latest Vercel deployment for this PR
        id: get-deploy
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
          PR_BRANCH: ${{ env.PR_BRANCH }}
        run: |
          echo "Fetching latest deployment for branch $PR_BRANCH"
-         response=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
-           "https://api.vercel.com/v6/deployments?projectId=$VERCEL_PROJECT_ID&limit=5")
+         response=$(curl -sf -H "Authorization: Bearer $VERCEL_TOKEN" \
+           "https://api.vercel.com/v6/deployments?projectId=$VERCEL_PROJECT_ID&limit=5") || {
+           echo "Failed to fetch deployments from Vercel API"
+           echo "found=false" >> $GITHUB_OUTPUT
+           exit 0
+         }
+         if [ -z "$response" ]; then
+           echo "Empty response from Vercel deployments API"
+           echo "found=false" >> $GITHUB_OUTPUT
+           exit 0
+         fi

Apply similar error handling to the status check (line 50–51) and logs fetch (line 64–65):

      - name: Check deployment status
        if: steps.get-deploy.outputs.found == 'true'
        id: check-status
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
          DEPLOYMENT_ID: ${{ env.DEPLOYMENT_ID }}
        run: |
-         status=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
-           "https://api.vercel.com/v13/deployments/$DEPLOYMENT_ID" | jq -r '.state')
+         response=$(curl -sf -H "Authorization: Bearer $VERCEL_TOKEN" \
+           "https://api.vercel.com/v13/deployments/$DEPLOYMENT_ID") || {
+           echo "Failed to fetch deployment status from Vercel API"
+           exit 1
+         }
+         status=$(echo "$response" | jq -r '.state')
          echo "Deployment failed. Fetching logs..."
-         logs=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
-           "https://api.vercel.com/v2/deployments/$DEPLOYMENT_ID/events")
+         logs=$(curl -sf -H "Authorization: Bearer $VERCEL_TOKEN" \
+           "https://api.vercel.com/v2/deployments/$DEPLOYMENT_ID/events") || {
+           echo "Failed to fetch deployment logs from Vercel API"
+           logs='[]'
+         }

Also applies to: 50-51, 64-65

🤖 Prompt for AI Agents
.github/workflows/vercel-fail-comment.yml lines 26-27 (and similarly 50-51,
64-65): the curl calls currently run without failure handling causing silent
continuation on network/HTTP errors; update each curl to use -f (fail on HTTP
errors), capture its exit status, and immediately check that the command
succeeded and returned a non-empty response (log a clear error with context and
exit or return non-zero on failure) before proceeding to parse the response;
apply the same pattern to the status check and logs fetch so any
HTTP/network/auth failure is detected and handled early.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants