ci: deploy full-stack previews to the local-preview server - #14030
Merged
Conversation
Contributor
Greptile SummaryThe PR adds a gated GitHub Actions job that builds the standalone web frontend, uploads it to the full-stack local-preview service using OIDC, deploys the matching commit, and posts the resulting URL to the source PR.
Confidence Score: 4/5The PR appears safe to merge, with a non-blocking issue that can produce duplicate preview comments on heavily discussed pull requests. The build and OIDC deployment path has no established blocking failure, while the unpaginated comment lookup can miss an older marker and post another status comment. Files Needing Attention: .github/workflows/preview.yml Important Files Changed
Sequence DiagramsequenceDiagram
participant G as GitHub push
participant A as Actions runner
participant P as Preview server
participant R as Pull request
G->>A: "Push to non-main branch touching web/**"
A->>A: Install dependencies and build frontend
A->>A: Assemble standalone upload tree
A->>P: OIDC-authenticated upload and deploy
P-->>A: Ready preview URL
A->>R: Create or update preview comment
Prompt To Fix All With AI### Issue 1
.github/workflows/preview.yml:133-134
**Paginate existing comment lookup**
When a pull request has more than the API's default page of comments and the deployment marker is on a later page, this lookup does not find it and posts another preview comment, leaving duplicate and potentially stale deployment links.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "ci: deploy full-stack previews to the lo..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 1 file
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 2 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
Contributor
|
Preview Deployment
|
Contributor
🖼️ Visual Regression Report
|
Contributor
|
Full-stack Preview (frontend + backend)
Sign in with GitHub as an |
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 2 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
jmelahman
force-pushed
the
local-preview-deploy
branch
from
August 18, 2026 20:29
be4384a to
bcb1371
Compare
justin-tahara
approved these changes
Aug 20, 2026
Adds a job that builds web/ and uploads it to the self-hosted preview server, which runs the Next.js frontend and the FastAPI backend together per commit at <sha>-onyx.preview.onyxcorp.dev. The Vercel job is untouched; this one deploys the backend alongside the frontend, which Vercel previews cannot. Only the frontend is uploaded. This workflow already builds it, and an uploaded side lands in the exact content-addressed slot the server's own build would have targeted, so the deploy skips rebuilding it. The backend is built server-side from the same commit. The build steps therefore have to match the server's manifest for this repo step for step — a divergence is a preview that differs from what a rebuild would produce. Uploads authenticate with a GitHub Actions OIDC token bound to this repository and to the server's audience, hence id-token: write. No PAT and no session are involved; those gate the dashboard and the previews themselves, which require signing in as an onyx-dot-app member. The job is gated on vars.PREVIEW_URL, so it stays dormant until that variable is set on the repo. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The job already took its server from vars.PREVIEW_URL, but a comment named the preview domain and the PR comment hardcoded the org the server admits. Both are properties of the deployment, not of this repo's CI, so they move to Actions variables managed in onyx-infra alongside PREVIEW_URL. PREVIEW_SSO_ORG is optional: it feeds one clause of the sign-in line, and the line drops that clause when it is unset. Pointing this workflow at a different local-preview deployment is now a variable change rather than a PR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The local-preview job needs to fire on backend-only commits; the Vercel job must not. Since `on:` is workflow-level, that split has to be two files rather than two path filters. The preview server no longer watches this repo (watch=false), so this workflow is the only thing that creates a preview — which is the point: CI builds the frontend on a GitHub runner and uploads it, instead of the single preview host rebuilding every branch itself. Deployment identity comes from the repo-level Actions variables PREVIEW_URL and PREVIEW_SSO_ORG, managed in the github-org Terraform workspace, so onyxcorp.dev is no longer hardcoded here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Path filters do not apply to workflow_dispatch, so this also covers a commit that changed neither web/ nor backend/ but still wants a preview. Only usable once this file reaches main — GitHub resolves dispatchable workflows from the default branch. Includes a throwaway file under web/ to trigger the path filter once, so the upload path gets exercised before merge. Reverted in the next commit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The frontend build is 128s of this job's 140s, and every run compiled the app from cold. Caching next build's incremental output is the lever; caching bun's install cache matches what pr-storybook-build.yml already does. Both are keyed so an unchanged tree restores exactly and a changed one still starts from the last build. Also drops the throwaway trigger file now that the pipeline has run green end to end. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Replace the `A && B || C` public copy with an if block, so a missing directory stays optional but a failed copy fails the job. actionlint flagged the old form (SC2015). Paginate the PR comment lookup: on a long PR the marker can sit past the first page, which posts a duplicate comment. Add a per-branch concurrency group so two commits deploying together cannot finish out of order and leave a stale preview URL. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
jmelahman
force-pushed
the
local-preview-deploy
branch
from
August 21, 2026 19:34
bcb1371 to
38720ee
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
Deploy-Local-Previewjob that buildsweb/and uploads it to the self-hosted preview server, which runs the Next.js frontend and the FastAPI backend together per commit at<sha>-onyx.<preview-domain>(the domain comes fromvars.PREVIEW_URL). The Vercel job is untouched — this one gives you a backend alongside the frontend, which Vercel previews cannot.How it works
Only the frontend is uploaded. This workflow already builds it, and an uploaded side lands in the exact content-addressed slot the server's own build would have targeted, so the deploy skips rebuilding it. The backend is built server-side from the same commit.
That makes the build steps load-bearing: they have to match the server's manifest for this repo step for step, or the preview differs from what a rebuild would produce. Both now build
@onyx-ai/sharedbefore@onyx-ai/opal, since opal depends on it.Uploads authenticate with a GitHub Actions OIDC token bound to this repository and to the server's audience — hence
id-token: write. No PAT and no session are involved; those gate the dashboard and the previews themselves, which require signing in as anonyx-dot-appmember.🤖 Generated with Claude Code
Summary by cubic
Deploys full‑stack previews via a new
local-preview.ymlso each commit gets a Next.js + FastAPI preview on the self‑hosted server fromvars.PREVIEW_URL. Previously only Vercel frontend; now the backend runs with the frontend and backend‑only commits get previews.web/**andbackend/**(excludingmain) and supports manualworkflow_dispatch; the Vercel workflow is unchanged and does not run for backend‑only commits.@onyx-ai/sharedbefore@onyx-ai/opaland uploads a minimal.next/standalonetree with static assets.id-token: write) and comments the preview URL on the PR.vars.PREVIEW_URLselects the server; optionalvars.PREVIEW_SSO_ORGonly alters the sign‑in note; no server identity is hardcoded.vars.PREVIEW_URLto enable.Written for commit 38720ee. Summary will update on new commits.