ci(preview): timing telemetry and preview ownership metadata (stage 1) - #1142
ci(preview): timing telemetry and preview ownership metadata (stage 1)#1142kyle-compute wants to merge 4 commits into
Conversation
Add the schema-v1 observability contract for the preview pipeline: - canonical preview generation (pr<N>-<sha12>) defined once in record_preview_metrics.py and exported as the detect-changes preview_generation output - a Record preview identity step in every job: PR, head SHA, generation, event action, and the component plan in each job summary - a final-gate Record preview metrics step that queries the Actions Jobs API and emits a machine-readable timing artifact (queue delay, container init, checkout/sync, database, Modal deploy, Vercel configure/build/ alias sub-phases via a new timings job output) plus a Markdown timing table; uploaded with 14-day retention - external identifiers (Supabase branch id/ref, Modal app/URL, Vercel deployment id/URL, GitHub deployment id) recorded through a fixed allowlist with URL userinfo/query redaction - metrics publication is always() + continue-on-error so telemetry can never fail or gate the required check No deployment behavior changes: same components, same order, same check name.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Risk: medium. Left a non-blocking comment: Cursor Bugbot found an unresolved medium-severity issue (telemetry steps can fail the required preview gate), and the Bugbot check did not pass. Assigned reviewers for human follow-up; Cursor Security Agent was not present on this PR.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Oddish previewCommit:
Vercel deployment URL: https://oddish-o6mmxe1gl.oddish.app Plan:
This comment is updated by the PR Preview workflow. |
Cursor Bugbot correctly flagged that a Record preview identity failure could flip its job and make the gate reject a working preview, and that the gate's new checkout was a hard dependency the gate never had. Every telemetry step is now continue-on-error; the gate checkout is advisory too (verify/publish do not use the working tree), so the whole telemetry chain degrades to missing metrics instead of a failed gate.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b4e1f4e. Configure here.
| DEPLOY_BACKEND: ${{ needs.detect-changes.outputs.deploy_backend }} | ||
| RUN_MIGRATIONS: ${{ needs.detect-changes.outputs.run_migrations }} | ||
| DEPLOY_FRONTEND: ${{ needs.detect-changes.outputs.deploy_frontend }} | ||
| run: python "$GITHUB_WORKSPACE/.github/scripts/preview/record_preview_metrics.py" identity |
There was a problem hiding this comment.
Gate checkout delays verification
Medium Severity
The gate's new Checkout repository and Record preview identity steps run before create/verify/publish, even though comments note verify/publish do not use the working tree. That puts a full checkout on the required-check critical path every run, adding avoidable latency against the stated few-second telemetry budget.
Reviewed by Cursor Bugbot for commit b4e1f4e. Configure here.
| DEPLOY_BACKEND: ${{ needs.detect-changes.outputs.deploy_backend }} | ||
| RUN_MIGRATIONS: ${{ needs.detect-changes.outputs.run_migrations }} | ||
| DEPLOY_FRONTEND: ${{ needs.detect-changes.outputs.deploy_frontend }} | ||
| run: python "$GITHUB_WORKSPACE/.github/scripts/preview/record_preview_metrics.py" identity |
There was a problem hiding this comment.
Identity skipped after step failure
Low Severity
Record preview identity uses continue-on-error: true but not if: always(), and in component jobs it is the final step. When an earlier deploy/prepare/vercel step fails, GitHub skips identity entirely, so failed jobs never get the ownership block that telemetry was added to provide.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit b4e1f4e. Configure here.
1 participant
Why this PR exists
What this PR changes
What this PR does not change
Evidence and validation
Risk
Merge gate
Before undrafting:
Stack order
Rollback
Revert this PR or remove the two soft telemetry steps. It changes no deployment or provider state, so there is nothing else to restore.