fix(ops): set x-release-id via Edge Middleware (#94)

Vercel serves committed vercel.json headers as-is, so build-time stamps
left production at "dev". Use Edge Middleware (or Astro middleware)
reading VERCEL_GIT_COMMIT_SHA instead.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jsolly

middleware.ts

@@ -0,0 +1,14 @@
+import { next } from "@vercel/edge";
+
+/**
+ * Request-time release id for static Vercel sites.
+ * Vercel applies committed vercel.json headers as-is (build-time stamps do not stick),
+ * so Edge Middleware reads the deployment's VERCEL_GIT_COMMIT_SHA instead.
+ */
+export default function middleware() {
+	const response = next();
+	const sha = process.env.VERCEL_GIT_COMMIT_SHA || process.env.GITHUB_SHA || "";
+	const releaseId = sha ? sha.slice(0, 12) : "dev";
+	response.headers.set("x-release-id", releaseId);
+	return response;
+}

package-lock.json

@@ -24,6 +24,7 @@
 		"@astrojs/sitemap": "^3.7.3",
 		"@astrojs/svelte": "^9.0.0",
 		"@tailwindcss/vite": "^4.3.1",
+		"@vercel/edge": "^1.3.1",
 		"astro": "^7.0.3",
 		"canvas-confetti": "^1.9.4",
 		"echarts": "^6.1.0",

package.json

@@ -1,33 +1,43 @@
 #!/usr/bin/env node
 /**
- * Contract: vercel.json wires x-release-id; production-like stamp ≠ "dev".
+ * Contract: Edge Middleware (or Astro middleware) wires x-release-id;
+ * production-like module stamp ≠ "dev".
  */
 import { execFileSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const vercelPath = resolve(repoRoot, "vercel.json");
 
-function headerValue(config) {
-	for (const block of config.headers ?? []) {
-		for (const h of block.headers ?? []) {
-			if (String(h.key).toLowerCase() === "x-release-id") return h.value;
-		}
+const edgeMw = resolve(repoRoot, "middleware.ts");
+const astroMw = resolve(repoRoot, "src/middleware.ts");
+if (existsSync(edgeMw)) {
+	const src = readFileSync(edgeMw, "utf8");
+	if (!src.includes("x-release-id") || !src.includes("VERCEL_GIT_COMMIT_SHA")) {
+		console.error("FAIL: root middleware.ts must set x-release-id from VERCEL_GIT_COMMIT_SHA");
+		process.exit(1);
 	}
-	return undefined;
-}
-
-const committed = JSON.parse(readFileSync(vercelPath, "utf8"));
-const committedVal = headerValue(committed);
-if (committedVal === undefined) {
-	console.error("FAIL: vercel.json missing x-release-id header");
+} else if (existsSync(astroMw)) {
+	const src = readFileSync(astroMw, "utf8");
+	if (!src.includes("x-release-id")) {
+		console.error("FAIL: src/middleware.ts must set x-release-id");
+		process.exit(1);
+	}
+} else {
+	console.error("FAIL: missing middleware.ts (Edge) or src/middleware.ts (Astro)");
 	process.exit(1);
 }
-if (committedVal !== "dev") {
-	console.error(`FAIL: committed vercel.json x-release-id must be "dev" (got ${committedVal})`);
-	process.exit(1);
+
+const vercelPath = resolve(repoRoot, "vercel.json");
+if (existsSync(vercelPath)) {
+	const vercel = readFileSync(vercelPath, "utf8");
+	if (/x-release-id/i.test(vercel)) {
+		console.error(
+			"FAIL: do not put x-release-id in vercel.json (committed value sticks; use Edge Middleware)",
+		);
+		process.exit(1);
+	}
 }
 
 const sha = "abcdef1234567890deadbeef";
@@ -36,34 +46,18 @@ execFileSync(process.execPath, [resolve(repoRoot, "scripts/gen-release-id.mjs")]
 	env: { ...process.env, VERCEL_GIT_COMMIT_SHA: sha },
 	stdio: "inherit",
 });
-
-const stamped = JSON.parse(readFileSync(vercelPath, "utf8"));
-const stampedVal = headerValue(stamped);
-const expected = sha.slice(0, 12);
-if (stampedVal !== expected) {
-	console.error(`FAIL: stamped x-release-id expected ${expected}, got ${stampedVal}`);
-	process.exit(1);
-}
-if (stampedVal === "dev") {
-	console.error("FAIL: production-like stamp must not be dev");
+const stamped = readFileSync(resolve(repoRoot, "src/release-id.ts"), "utf8");
+if (!stamped.includes(`RELEASE_ID = "${sha.slice(0, 12)}"`)) {
+	console.error("FAIL: module stamp missing expected SHA");
 	process.exit(1);
 }
 
 execFileSync(process.execPath, [resolve(repoRoot, "scripts/restore-release-stub.mjs")], {
 	cwd: repoRoot,
-	env: { ...process.env, VERCEL: "" },
 	stdio: "inherit",
 });
-
-const restored = JSON.parse(readFileSync(vercelPath, "utf8"));
-if (headerValue(restored) !== "dev") {
-	console.error("FAIL: restore did not reset x-release-id to dev");
-	process.exit(1);
-}
-
-// Ensure module stub is back
-const mod = readFileSync(resolve(repoRoot, "src/release-id.ts"), "utf8");
-if (!mod.includes('RELEASE_ID = "dev"')) {
+const restored = readFileSync(resolve(repoRoot, "src/release-id.ts"), "utf8");
+if (!restored.includes('RELEASE_ID = "dev"')) {
 	console.error("FAIL: release-id.ts stub not restored");
 	process.exit(1);
 }

scripts/check-release-id.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 /**
- * Build-time release id for static Vercel sites.
- * Stamps x-release-id into vercel.json headers and writes src/release-id.ts.
- * SHA: VERCEL_GIT_COMMIT_SHA → GITHUB_SHA → git rev-parse HEAD → "dev"
+ * Writes src/release-id.ts with the current git commit SHA (12-char) for HTML meta.
+ * Response header x-release-id is set by Edge Middleware (VERCEL_GIT_COMMIT_SHA) —
+ * do not stamp vercel.json; Vercel serves committed headers as-is.
  */
 import { execSync } from "node:child_process";
-import { readFileSync, writeFileSync } from "node:fs";
+import { writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -31,28 +31,8 @@ if (sha && !fromEnv) {
 	if (dirty) releaseId += "-dirty";
 }
 
-const modulePath = resolve(repoRoot, "src/release-id.ts");
 writeFileSync(
-	modulePath,
+	resolve(repoRoot, "src/release-id.ts"),
 	`// Generated by scripts/gen-release-id.mjs — do not commit the generated version.\nexport const RELEASE_ID = ${JSON.stringify(releaseId)};\n`,
 );
-
-const vercelPath = resolve(repoRoot, "vercel.json");
-const config = JSON.parse(readFileSync(vercelPath, "utf8"));
-if (!Array.isArray(config.headers)) config.headers = [];
-let catchAll = config.headers.find((h) => h.source === "/(.*)");
-if (!catchAll) {
-	catchAll = { source: "/(.*)", headers: [] };
-	config.headers.push(catchAll);
-}
-if (!Array.isArray(catchAll.headers)) catchAll.headers = [];
-const existing = catchAll.headers.find(
-	(h) => String(h.key).toLowerCase() === "x-release-id",
-);
-if (existing) {
-	existing.value = releaseId;
-} else {
-	catchAll.headers.push({ key: "x-release-id", value: releaseId });
-}
-writeFileSync(vercelPath, `${JSON.stringify(config, null, "\t")}\n`);
 process.stdout.write(`release-id: ${releaseId}\n`);

scripts/gen-release-id.mjs

@@ -1,34 +1,12 @@
 #!/usr/bin/env node
-/**
- * Restore committed stubs after build so generated release ids are never committed.
- * On Vercel, leave vercel.json stamped (headers are read from the build tree);
- * always restore src/release-id.ts so a failed local build cannot leave a dirty module.
- */
-import { writeFileSync, readFileSync } from "node:fs";
+/** Restore src/release-id.ts stub after build. */
+import { writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-
 writeFileSync(
 	resolve(repoRoot, "src/release-id.ts"),
 	'// Stub — overwritten at build time by scripts/gen-release-id.mjs. Do not commit the generated version.\nexport const RELEASE_ID = "dev";\n',
 );
-
-// Vercel serves headers from the post-build vercel.json — do not wipe the stamp there.
-if (process.env.VERCEL === "1") {
-	process.stdout.write("release-id module stub restored (vercel.json left stamped)\n");
-	process.exit(0);
-}
-
-const vercelPath = resolve(repoRoot, "vercel.json");
-const config = JSON.parse(readFileSync(vercelPath, "utf8"));
-for (const block of config.headers ?? []) {
-	for (const h of block.headers ?? []) {
-		if (String(h.key).toLowerCase() === "x-release-id") {
-			h.value = "dev";
-		}
-	}
-}
-writeFileSync(vercelPath, `${JSON.stringify(config, null, "\t")}\n`);
-process.stdout.write("release-id stubs restored\n");
+process.stdout.write("release-id stub restored\n");

scripts/restore-release-stub.mjs

@@ -27,10 +27,6 @@
 				{
 					"key": "X-Content-Type-Options",
 					"value": "nosniff"
-				},
-				{
-					"key": "x-release-id",
-					"value": "dev"
 				}
 			]
 		}