feat: auto-cleanup Cloudflare preview alias on PR close - #189
Conversation
Only the job runs on events (no lint/tests/build). The job skips closed PRs entirely.
✅ Deploy Preview for dev-bayanflow ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe workflow now includes ChangesCloudflare PR preview lifecycle
Sequence Diagram(s)sequenceDiagram
participant PR as GitHub pull request
participant WF as preview-cloudflare workflow
participant Script as cleanup shell script
participant CF as Cloudflare Workers staging
PR->>WF: pull_request closed event
WF->>Script: run Cleanup preview on PR close
Script->>CF: wrangler versions list tag pr-<PR number>
CF-->>Script: matching staging version or none
alt version found
Script->>CF: delete the matched version
else no version found
Script-->>WF: log no preview version exists
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Preview for Bayan Flow Staging ready!
Preview alias |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/preview-cloudflare.yml:
- Around line 140-151: The cleanup job in the workflow is still checking out the
repository with default credentials and using pnpm caching before running
dependency installation, which should be hardened. Update the checkout step in
this cleanup path to disable persisted credentials the same way as the preview
job, and remove the pnpm cache configuration from actions/setup-node before the
pnpm install step. Keep the changes localized to the cleanup job steps around
actions/checkout, actions/setup-node, and pnpm install.
- Line 135: The cleanup step in the preview workflow is missing the same
same-repo guard used by the preview upload job, so it can run for closed PRs
from forks and attempt to delete aliases it never created. Update the cleanup
condition in the workflow so the job gated by github.event.action == 'closed'
also checks the same repository ownership/same-repo criteria as the preview job,
using the existing preview job gate logic as the reference.
- Around line 153-161: The preview cleanup step is using an unsupported Wrangler
alias flag, so update the Delete preview alias workflow step to use the
supported Wrangler preview-alias cleanup approach instead of versions delete
--alias. Adjust the command in the cloudflare/wrangler-action invocation so it
matches the same preview alias mechanism used by the upload step, and keep the
pr-${{ github.event.pull_request.number }} alias reference consistent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ec6a51a2-378d-46e5-b3ad-ed80f2c6511d
📒 Files selected for processing (1)
.github/workflows/preview-cloudflare.yml
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. The branch was updated while autofix was in progress. Please try again. |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. The agent generated fixes only for
Lines 132–143
cleanup:
name: Cleanup preview on PR close
- if: github.event.action == 'closed'
+ if: github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+ with:
+ persist-credentials: false
- uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
with:Lines 146–152 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: 24.11.1
- cache: pnpm
- run: pnpm install --frozen-lockfileLines 157–161 accountId: ${{ secrets.CF_ACCOUNT_ID }}
packageManager: pnpm
command: >-
- versions delete --alias pr-${{ github.event.pull_request.number }}
- --env staging
+ versions upload --env staging
+ --preview-alias ""
+ --tag pr-${{ github.event.pull_request.number }} |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 1 file(s) based on 3 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken:
Lines 132–143
cleanup:
name: Cleanup preview on PR close
- if: github.event.action == 'closed'
+ if: github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+ with:
+ persist-credentials: false
- uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
with:Lines 146–152 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: 24.11.1
- cache: pnpm
- run: pnpm install --frozen-lockfileLines 157–161 accountId: ${{ secrets.CF_ACCOUNT_ID }}
packageManager: pnpm
command: >-
- versions delete --alias pr-${{ github.event.pull_request.number }}
- --env staging
+ versions upload --env staging
+ --preview-alias "" |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 100-101: Move the vite substitution from the top-level overrides
block into pnpm’s override configuration so it continues to apply. Update the
package.json pnpm.overrides section for pnpm <11, or place the mapping in
pnpm-workspace.yaml for pnpm 11+, and remove the top-level overrides entry.
- Around line 100-101: The Vite override is currently placed in package.json,
but pnpm will not apply this top-level override there on clean installs. Move
the vite-to-rolldown-vite@7.2.10 substitution into pnpm-workspace.yaml and
remove it from package.json so the dependency replacement is applied
consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| "overrides": { | ||
| "vite": "npm:rolldown-vite@7.2.10" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Determine pnpm version intent and current overrides placement
fd -t f 'package.json' --max-depth 2 --exec sh -c '
echo "=== {} ==="
jq "{packageManager, engines, topOverrides: .overrides, pnpmOverrides: .pnpm.overrides}" "{}"
'
echo "=== pnpm-workspace.yaml (v11 overrides destination) ==="
fd -t f 'pnpm-workspace.yaml' --exec cat {}
echo "=== lockfileVersion + overrides block ==="
fd -t f 'pnpm-lock.yaml' --exec sed -n '1,25p' {}Repository: ayoub3bidi/bayan-flow
Length of output: 1074
🌐 Web query:
pnpm overrides package.json top-level overrides pnpm.overrides documentation
💡 Result:
As of pnpm version 11, the pnpm.overrides configuration is no longer supported within the package.json file [1][2][3]. Any overrides defined there will be silently ignored [1][2]. To use overrides in pnpm v11 and later, you must define them in a pnpm-workspace.yaml file located at the root of your project [4][5][2]. The overrides field allows you to force specific versions of dependencies, including transitive dependencies, which is useful for security patches or compatibility fixes [4][6][7]. Configuration in pnpm-workspace.yaml uses the following syntax: overrides: "foo": "^1.0.0" "bar@^2.1.0": "3.0.0" "qar@1>zoo": "2" Key points for migration and usage: - Location: The overrides field must be at the root of the project in pnpm-workspace.yaml [4][5]. - Legacy Support: Versions of pnpm prior to 11 supported the pnpm.overrides field in package.json, but this has been deprecated and removed in favor of the workspace configuration [8][1][3]. - Granularity: You can override a dependency globally or specify that an override should only apply when a dependency is used by a specific parent package using the > syntax (e.g., parent>child) [4][6]. - Referencing: You can reference a direct dependency's spec by using the $ prefix (e.g., foo: $foo) [4][5]. - Removal: Use the - value to remove a dependency entirely (e.g., foo: -) [4][6]. If you are upgrading from an older version of pnpm, you should move your overrides from package.json to pnpm-workspace.yaml, then delete your node_modules and lockfile (pnpm-lock.yaml) to ensure a clean re-installation [2].
Citations:
- 1: pnpm 11 silently ignores
pnpm.overridesandpnpm.patchedDependenciesinpackage.json(no deprecation warning, security-critical) pnpm/pnpm#11536 - 2: https://sharepoint.stackexchange.com/questions/317387/pnpm-overrides-not-working-from-package-json-after-pnpm-upgrade
- 3: feat!: stop reading settings from the pnpm field of package.json pnpm/pnpm#10086
- 4: https://pnpm.io/settings
- 5: https://pnpm.io/10.x/settings
- 6: https://github.com/pnpm/pnpm.io/blob/main/versioned_docs/version-10.x/settings.md
- 7: https://github.com/antfu/skills/blob/main/skills/pnpm/references/features-overrides.md
- 8: https://github.com/pnpm/pnpm.io/blob/main/versioned_docs_archived/version-7.x/package_json.md
Move the vite override into pnpm’s config.
Top-level overrides in package.json is not the pnpm location, so this vite -> npm:rolldown-vite@7.2.10 substitution can stop applying. Keep it under pnpm.overrides for pnpm <11, or in pnpm-workspace.yaml for pnpm 11+.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 100 - 101, Move the vite substitution from the
top-level overrides block into pnpm’s override configuration so it continues to
apply. Update the package.json pnpm.overrides section for pnpm <11, or place the
mapping in pnpm-workspace.yaml for pnpm 11+, and remove the top-level overrides
entry.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Inspect full overrides-related structure and pnpm version pinning
fd -t f 'package.json' --max-depth 2 --exec sh -c '
echo "=== {} ==="
jq "{overrides, pnpm, packageManager, devVite: .devDependencies.vite, depVite: .dependencies.vite}" "{}"
'
echo "=== pnpm-lock overrides block ==="
fd -t f 'pnpm-lock.yaml' --exec sed -n "1,20p" {}Repository: ayoub3bidi/bayan-flow
Length of output: 811
🌐 Web query:
Does pnpm support the top-level overrides field in package.json or only pnpm.overrides
💡 Result:
In modern versions of pnpm (specifically starting from v11), configuration settings, including overrides, are no longer supported in the package.json file [1][2]. The pnpm field in package.json is ignored, and pnpm does not support the top-level overrides field used by npm [1][2]. All configuration for overrides must now be defined in the workspace manifest file, pnpm-workspace.yaml, at the root of the project [3][4][1]. Key points regarding the current configuration model: - Location: The canonical location for overrides is now pnpm-workspace.yaml [4][1][2]. - Compatibility: pnpm does not use the standard npm top-level overrides field in package.json [1][5]. It maintains its own specific syntax and functionality (such as the ability to remove dependencies using - or scope overrides via the > selector) within the overrides block of pnpm-workspace.yaml [3][4][6]. - Migration: If you are upgrading to pnpm v11 or later, you must move any previous pnpm.overrides settings from your package.json into pnpm-workspace.yaml, as they will be ignored in the former location [2].
Citations:
- 1: feat!: stop reading settings from the pnpm field of package.json pnpm/pnpm#10086
- 2: pnpm 11 silently ignores
pnpm.overridesandpnpm.patchedDependenciesinpackage.json(no deprecation warning, security-critical) pnpm/pnpm#11536 - 3: https://pnpm.io/settings
- 4: https://pnpm.io/10.x/settings
- 5: Use overrides not pnpm.overrides pnpm/pnpm#7421
- 6: Implement "overrides" that is compatible with npm 8.3 "overrides" pnpm/pnpm#4190
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== package.json manifest fields around overrides ==="
sed -n '85,110p' package.json | cat -n
echo "=== workspace / pnpm config files ==="
fd -a 'pnpm-workspace.yaml' .
fd -a '.npmrc' .
fd -a 'package.json' . | head -n 20Repository: ayoub3bidi/bayan-flow
Length of output: 937
🌐 Web query:
pnpm package.json top-level overrides support official docs
💡 Result:
As of pnpm version 11, pnpm no longer supports defining overrides within the package.json file [1]. Settings that were previously defined in the pnpm field of package.json, including overrides, must now be defined in the pnpm-workspace.yaml file [1]. In versions of pnpm prior to v11, overrides were typically configured under the pnpm.overrides key within package.json [2]. However, upgrading to pnpm v11 or later will cause any overrides defined in the legacy package.json location to be ignored, often without an explicit error or warning [3][4][5]. To correctly implement overrides in modern pnpm, you must move the configuration to the root of your project in a pnpm-workspace.yaml file [6][3]: overrides: package-name: "version-or-range" This configuration ensures that pnpm properly applies the specified version overrides across your project's dependency graph [6].
Citations:
- 1: https://pnpm.io/next/package_json
- 2: https://github.com/pnpm/pnpm.io/blob/main/versioned_docs_archived/version-7.x/package_json.md
- 3: https://sharepoint.stackexchange.com/questions/317387/pnpm-overrides-not-working-from-package-json-after-pnpm-upgrade
- 4: pnpm 11 silently ignores
pnpm.overridesandpnpm.patchedDependenciesin package.json (no deprecation warning etc...) pnpm/pnpm#11677 - 5: pnpm 11 silently ignores
pnpm.overridesandpnpm.patchedDependenciesinpackage.json(no deprecation warning, security-critical) pnpm/pnpm#11536 - 6: https://pnpm.io/settings
🌐 Web query:
site:pnpm.io package_json overrides pnpm package.json top-level overrides
💡 Result:
In modern versions of pnpm, the overrides feature is not configured directly in the top-level package.json file [1][2]. Instead, it must be defined in the pnpm-workspace.yaml file located at the root of your project [1][3]. Key points regarding pnpm overrides: - Location: The overrides field is strictly enforced at the root of the project within the pnpm-workspace.yaml file [1][3]. - Functionality: It allows you to force a specific version of a dependency throughout your dependency graph, replace a dependency with a fork, backport fixes, or remove an unnecessary dependency [1][3]. - Usage: You define overrides by mapping a package selector to a version specifier. You can also target specific dependencies of a parent package using the > syntax (e.g., pkg@version>dependency: new-version) [1][2]. - Removal: To remove a dependency entirely, you can set the override value to "-" (e.g., "foo@1.0.0>bar": "-") [1][2]. - Legacy/Alternative Methods: - While older versions of pnpm may have allowed certain configurations within the pnpm field of package.json, pnpm (since v11) no longer reads settings from that field [4]. - For advanced, dynamic manipulation of manifests during installation, the.pnpmfile.mjs (readPackage hook) can be used, though this is distinct from the declarative overrides feature [5]. - For permanent changes to a dependency's source code or its manifest file, pnpm patch is the recommended approach rather than attempting to override dependencies via patching [6].
Citations:
- 1: https://pnpm.io/settings
- 2: https://pnpm.io/10.x/settings
- 3: https://pnpm.io/next/settings
- 4: https://pnpm.io/package_json
- 5: https://pnpm.io/pnpmfile
- 6: https://pnpm.io/cli/patch
Move this override out of package.json. pnpm doesn’t read top-level overrides here, so the vite → rolldown-vite@7.2.10 substitution won’t apply on clean installs. Put it in pnpm-workspace.yaml instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 100 - 101, The Vite override is currently placed
in package.json, but pnpm will not apply this top-level override there on clean
installs. Move the vite-to-rolldown-vite@7.2.10 substitution into
pnpm-workspace.yaml and remove it from package.json so the dependency
replacement is applied consistently.
a2f0f31 to
a7e6935
Compare
1 participant
Contribution workflow
develop: This PR targetsdevelop, notmain.Description
Adds an automatic cleanup job that deletes the Cloudflare Workers preview alias (
pr-N-bayan-flow-staging.workers.dev) when a PR is closed or merged. Without this, orphaned preview aliases accumulate indefinitely — they still resolve and consume from the free tier request pool.Type of Change
Related Issues
N/A
Changes Made
closedto thepull_requesttrigger types inpreview-cloudflare.ymlpreview— runs only onopened | synchronize | reopened(lint, tests, build, upload, comment)cleanup— runs only onclosed(minimal checkout +wrangler versions delete --alias)previewjob now guards against running onclosedviagithub.event.action != 'closed'Testing
Code Quality
pnpm lint)pnpm format)Performance Impact
Breaking Changes
Checklist
Additional Notes
The cleanup job still does a minimal checkout + pnpm install because
wrangler versions deleteneeds thewrangler.jsoncconfig to resolve the staging environment.Summary by CodeRabbit