chore(ci): no more pull_request_target by avivkeller · Pull Request #8992 · nodejs/nodejs.org

avivkeller · 2026-07-01T21:30:07Z

No description provided.

vercel · 2026-07-01T21:30:13Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nodejs-org	Ready	Preview	Jul 6, 2026 8:37pm

cursor · 2026-07-01T21:30:15Z

PR Summary

Medium Risk
Workflow architecture and token/comment paths change in security-sensitive CI; misconfiguration could break PR comments or Chromatic until verified on fork and same-repo PRs.

Overview
CI security and PR feedback move off pull_request_target for Chromatic and Lighthouse, and PR comments are no longer posted from those untrusted runs.

Lighthouse and the new Compare Bundle Size job in build.yml only upload a pr-comment artifact (body + tag). A new Leave Comment workflow_run workflow downloads that artifact and posts or updates the PR comment via thollander/actions-comment-pull-request, including fork PRs by resolving the PR number when workflow_run does not link one. The standalone bundle-compare.yml workflow is removed; comparison runs in the same Build workflow on PRs, with base stats fetched via gh run list on the base SHA.

Bundle size reporting now uses Next/Turbopack route-bundle-stats.json instead of webpack-stats.json, and compare-size/index.mjs compares per-route first load JS rather than webpack asset lists.

Chromatic triggers on pull_request (no label requirement), bumps chromaui/action to v18, and reads CHROMATIC_PROJECT_TOKEN from vars instead of secrets.

^{Reviewed by Cursor Bugbot for commit 6a95094. Bugbot is set up for automated code reviews on this repo. Configure here.}

codecov · 2026-07-01T21:32:15Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.41%. Comparing base (b75ea02) to head (6a95094).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8992   +/-   ##
=======================================
  Coverage   75.41%   75.41%           
=======================================
  Files          98       98           
  Lines        8636     8636           
  Branches      318      318           
=======================================
  Hits         6513     6513           
  Misses       2119     2119           
  Partials        4        4

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

Copilot

Pull request overview

This PR removes usage of the privileged pull_request_target trigger in CI workflows and replaces direct PR-commenting with a safer two-workflow pattern: untrusted pull_request workflows serialize comment data into an artifact, and a trusted workflow_run workflow posts the comment after completion.

Changes:

Switch Lighthouse and Chromatic workflows from pull_request_target to pull_request and adjust permissions/commenting behavior accordingly.
Add a new Leave Comment workflow that downloads a pr-comment artifact on workflow_run completion and posts it to the PR.
Replace the standalone bundle-compare workflow_run workflow by integrating bundle comparison into the main Build workflow and emitting a pr-comment artifact.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
.github/workflows/lighthouse.yml	Runs Lighthouse in `pull_request` context and uploads a `pr-comment` artifact instead of commenting directly.
.github/workflows/leave-comment.yml	New trusted `workflow_run` workflow intended to post PR comments based on downloaded artifacts.
.github/workflows/chromatic.yml	Moves Chromatic to `pull_request` and changes how the Chromatic token is sourced.
.github/workflows/bundle-compare.yml	Removes the old standalone bundle compare `workflow_run` workflow.
.github/workflows/build.yml	Adds an in-workflow bundle size comparison job and uploads `pr-comment` artifacts for trusted commenting.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

    if: |
-      github.event_name != 'pull_request_target' ||
+      github.event_name != 'pull_request' ||
      (
-        github.event.label.name == 'github_actions:pull-request' &&
        github.actor != 'dependabot[bot]' &&
        github.event.pull_request.head.ref != 'chore/crowdin'


bmuenzenmeyer · 2026-07-08T02:10:44Z

          workingDir: packages/ui-components
          buildScriptName: storybook:build
-          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
+          projectToken: ${{ vars.CHROMATIC_PROJECT_TOKEN }}


can we make sure we talk about this in writing?

(edit so it's near the review: https://www.chromatic.com/docs/github-actions/#project-token-secret)

yeah, per https://www.chromatic.com/docs/github-actions/#project-token-secret isnt this a secet?

A few sections later in that same file, https://www.chromatic.com/docs/github-actions/#run-chromatic-on-external-forks-of-open-source-projects:

Sharing project tokens allows contributors and others to run Chromatic builds on your project, which can use snapshots. They cannot access your account, settings, or accept baselines. This can be an acceptable tradeoff for open source projects that value community contributions.

avivkeller · 2026-07-03T03:08:21Z

Not sure why Next.js didn't generate the stats file... maybe something changed?

avivkeller · 2026-07-03T03:09:15Z

Looks like TURBOPACK_STATS is broken, and has been for some time. @MattIPv4 It's not really idiomatic, but I'm going to update this PR to also fix this.

Signed-off-by: Aviv Keller <me@aviv.sh>

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 827ce1d. Configure here.}

Signed-off-by: Aviv Keller <me@aviv.sh>

avivkeller · 2026-07-07T14:53:49Z

@nodejs/nodejs-website for approval

bmuenzenmeyer

one comment i want to better understand. making another pass now

bmuenzenmeyer · 2026-07-08T02:10:44Z

          workingDir: packages/ui-components
          buildScriptName: storybook:build
-          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
+          projectToken: ${{ vars.CHROMATIC_PROJECT_TOKEN }}


can we make sure we talk about this in writing?

(edit so it's near the review: https://www.chromatic.com/docs/github-actions/#project-token-secret)

bmuenzenmeyer

want to make sure we all look at this slower.
https://www.chromatic.com/docs/github-actions/#forked-repositories does suggest this pattern (plaintext vs vars), with it as a tradeoff for just this use case. are we accepting of the possible misuse of quota from forks?

avivkeller · 2026-07-08T05:01:10Z

(Copying my review comment for visibility)

A few sections later in that same file, https://www.chromatic.com/docs/github-actions/#run-chromatic-on-external-forks-of-open-source-projects:

Sharing project tokens allows contributors and others to run Chromatic builds on your project, which can use snapshots. They cannot access your account, settings, or accept baselines. This can be an acceptable tradeoff for open source projects that value community contributions.

avivkeller · 2026-07-08T05:03:11Z

IMHO the risk of a misused quota is substantially lower than the risk of a misconfigured/vulnerable pull_request_target.

The worst case scenario is that we get some spam Storybook builds that affect our (very high) quota of which we use very little.

The worst case scenario of a compromised workflow, on the other hand, is far more dangerous

Copilot AI review requested due to automatic review settings July 1, 2026 21:30

avivkeller requested a review from a team as a code owner July 1, 2026 21:30

avivkeller had a problem deploying to Storybook July 1, 2026 21:30 — with GitHub Actions Failure

github-advanced-security AI found potential problems Jul 1, 2026

View reviewed changes

Comment thread .github/workflows/leave-comment.yml Fixed

Copilot started reviewing on behalf of avivkeller July 1, 2026 21:30 View session

cursor Bot reviewed Jul 1, 2026

View reviewed changes

Comment thread .github/workflows/build.yml

avivkeller had a problem deploying to Storybook July 1, 2026 21:33 — with GitHub Actions Failure

MattIPv4 reviewed Jul 1, 2026

View reviewed changes

Comment thread .github/workflows/leave-comment.yml

Copilot AI reviewed Jul 1, 2026

View reviewed changes

chore(ci): no more pull_request_target

a7c4907

avivkeller force-pushed the no-target branch from 0fa0f8d to a7c4907 Compare July 1, 2026 21:51

avivkeller had a problem deploying to Storybook July 1, 2026 21:51 — with GitHub Actions Failure

vercel Bot deployed to Preview July 1, 2026 21:52 View deployment

cursor Bot reviewed Jul 1, 2026

View reviewed changes

Comment thread .github/workflows/leave-comment.yml

fixup!

c075acf

avivkeller deployed to Storybook July 3, 2026 04:22 — with GitHub Actions View deployment

vercel Bot deployed to Preview July 3, 2026 04:23 View deployment

cursor Bot reviewed Jul 3, 2026

View reviewed changes

Comment thread .github/workflows/build.yml

Merge branch 'main' into no-target

27b091a

Signed-off-by: Aviv Keller <me@aviv.sh>

avivkeller deployed to Storybook July 4, 2026 03:42 — with GitHub Actions View deployment

vercel Bot deployed to Preview July 4, 2026 03:43 View deployment

fixup!

2796374

avivkeller requested a review from a team as a code owner July 4, 2026 20:05

avivkeller requested a review from MattIPv4 July 4, 2026 20:05

avivkeller had a problem deploying to Storybook July 4, 2026 20:05 — with GitHub Actions Error

fixup!

efab82a

avivkeller deployed to Storybook July 4, 2026 20:06 — with GitHub Actions View deployment

vercel Bot deployed to Preview July 4, 2026 20:07 View deployment

avivkeller requested a review from a team July 4, 2026 20:19

MattIPv4 reviewed Jul 4, 2026

View reviewed changes

Comment thread .github/workflows/leave-comment.yml Outdated

zizmor justification

827ce1d

Signed-off-by: Aviv Keller <me@aviv.sh>

avivkeller deployed to Storybook July 6, 2026 03:14 — with GitHub Actions View deployment

vercel Bot deployed to Preview July 6, 2026 03:15 View deployment

cursor Bot reviewed Jul 6, 2026

View reviewed changes

Comment thread .github/workflows/leave-comment.yml Outdated

Update leave-comment.yml

a2d20bb

Signed-off-by: Aviv Keller <me@aviv.sh>

avivkeller had a problem deploying to Storybook July 6, 2026 20:35 — with GitHub Actions Error

lint

6a95094

Signed-off-by: Aviv Keller <me@aviv.sh>

avivkeller deployed to Storybook July 6, 2026 20:36 — with GitHub Actions View deployment

vercel Bot deployed to Preview July 6, 2026 20:37 View deployment

avivkeller requested a review from MattIPv4 July 7, 2026 04:00

MattIPv4 approved these changes Jul 7, 2026

View reviewed changes

bmuenzenmeyer reviewed Jul 8, 2026

View reviewed changes

bmuenzenmeyer requested changes Jul 8, 2026

View reviewed changes

Uh oh!

Conversation

avivkeller commented Jul 1, 2026

Uh oh!

vercel Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

bmuenzenmeyer Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmuenzenmeyer Jul 8, 2026

Choose a reason for hiding this comment

Uh oh!

avivkeller Jul 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

avivkeller commented Jul 3, 2026

Uh oh!

avivkeller commented Jul 3, 2026

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

avivkeller commented Jul 7, 2026

Uh oh!

bmuenzenmeyer left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmuenzenmeyer Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmuenzenmeyer left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

avivkeller commented Jul 8, 2026

Uh oh!

avivkeller commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

vercel Bot commented Jul 1, 2026 •

edited

Loading

cursor Bot commented Jul 1, 2026 •

edited

Loading

codecov Bot commented Jul 1, 2026 •

edited

Loading

bmuenzenmeyer Jul 8, 2026 •

edited

Loading

bmuenzenmeyer left a comment •

edited

Loading

bmuenzenmeyer Jul 8, 2026 •

edited

Loading

bmuenzenmeyer left a comment •

edited

Loading