mirror of
https://github.com/vercel/next.js.git
synced 2026-09-20 02:25:18 +08:00
Sebastian "Sebbie" Silbermann
7dcf6c0a68
Replaces the static `PREVIEW_BUILDS_BLOB_READ_WRITE_TOKEN` secret with a short-lived access token to upload to Vercel Blob in exchange for a GitHub OIDC (endpoint side: https://github.com/vercel/vercel-packages/pull/98): - the job mints GitHub Actions OIDC tokens for the `https://vercel-packages.vercel.app` audience itself (the workflow gains `id-token: write`) and re-mints shortly before expiry since a token lives about five minutes while a package batch can take longer - `upload-preview-tarballs.js` exchanges the token at vercel-packages for scoped client-upload tokens via POST and uploads the tarball bytes directly to Blob storage with `@vercel/blob/client`'s `put`, so the blob read-write token never leaves vercel-packages - the `preview-builds` environment is dropped from the job: it only existed to selectively expose the static token and restrict uploads to canary, and the canary binding is now enforced by the `job_workflow_ref` match at vercel-packages. --------- Co-authored-by: Claude Code (kimi-k3[1m]) <noreply@anthropic.com>