Repository navigation
docs(security): keep server secrets out of Vercel builds; park a secret-free deploy workflow (#920) - #926
Merged
Conversation
…et-free deploy workflow (#920)
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Thanks for your contribution! ❤️ It looks like this PR isn't linked to an issue yet. Please add |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Production builds run merged
package.jsonscripts with whatever the Vercel project exposes at build time (#920). TheheliobondVercel project holds no environment variables in any environment today, so there is nothing for a malicious build script to steal. This PR keeps it that way and parks the fix for when the real backend is connected.SECURITY.md: new "Deployment secrets" section. No server secret (for exampleHELIOBOND_API_KEY) goes into Vercel until production builds move off Vercel's git integration.docs/MAINNET_CHECKLIST.md: the same rule as a release item..github/workflows/deploy.yml(parked, manual trigger only): a secret-free production pipeline in three jobs.settingspulls the project settings with the token and deletes the pulled env file. It never checks out repo code.buildbuilds with no token and no secrets. Public values come from repository variables.deployuploads the prebuilt output with the token. It never runs repo code.Server secrets stay in Vercel for runtime only. Actions are pinned to commit SHAs and the Vercel CLI is pinned. The header comment lists the three steps to switch it on.
Linked issue
Refs #920. It stays open until the workflow is switched on, which has to happen before backend secrets are added.
Type of change
Notes for reviewers
workflow_dispatchonly, so merging it changes nothing about how production deploys today.productionenvironment (VERCEL_TOKEN,VERCEL_ORG_ID,VERCEL_PROJECT_ID) and theNEXT_PUBLIC_*repository variables.SECURITY.mdandMAINNET_CHECKLIST.mdare also edited by ci: supply-chain guardrails for hidden payloads and build scripts (#914, #915, #921, #920) #924, but in different sections, so they shouldn't conflict.