fix(ci): build frontend on runner instead of Oryx - #58
Merged
Merged
Conversation
Oryx (the builder bundled into the Static Web Apps action) only supports Node up to 22.22.0 on the 22.x line, but CIPP now requires engines.node ^22.22.2. Every deploy since the 10.10.2 merge has failed with: Error: Platform 'nodejs' version '^22.22.2' is unsupported. Oryx has found build steps, but identified unsupported platform versions. Build with actions/setup-node instead, reading the version from package.json so future upstream bumps don't re-break this, then hand the finished artifact to SWA via skip_app_build. This mirrors the approach already used by the upstream cipp_frontend_build.yml workflow. Note that with skip_app_build, app_location becomes the pre-built output directory and output_location must be empty. Also sets skip_deploy_on_missing_secrets so Dependabot PRs (which cannot read repository secrets by design) stop failing with "deployment_token was not provided". Those runs have been red since at least July and were masking genuine failures like this one. The build still runs on those PRs, so dependency bumps are validated; only the deploy is skipped. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Frontend deploys have been failing since the 10.10.2 upstream merge:
CIPP requires
engines.node: ^22.22.2. Oryx — the builder bundled into the Static Web Apps action — tops out at 22.22.0 on the 22.x line, so it refuses the build.This is not a local misconfiguration:
pncit/CIPPpackage.jsonis identical to upstreamKelvinTegelaar/CIPP. Upstream never hits it because upstream doesn't deploy to SWA, so this surfaces only in forks wired to Static Web Apps.Impact: the SWA site is still serving the last successful build, so the frontend is pinned at 10.10.1 while the backend has moved to 10.10.2.
Fix
Build on the runner and hand SWA the finished artifact:
actions/setup-node(pinned to a SHA, perci: pin our deploy workflow's action refs), with the version read frompackage.jsonrather than hardcoded, so future upstream Node bumps don't re-break thisyarn install --frozen-lockfile(repo hasyarn.lock, nopackage-lock.json) thennpm run buildskip_app_build: true, which per the SWA build-configuration docs makesapp_locationthe pre-built output directory and requiresoutput_locationto be emptyThis mirrors the approach already used by upstream's own
cipp_frontend_build.yml, which doesn't run on forks (if: github.event.repository.fork == false).Also: Dependabot noise
Adds
skip_deploy_on_missing_secrets: true. Dependabot PRs can't read repository secrets by design, so everychore(deps)run has failed withdeployment_token was not providedsince at least July. That constant red masked this genuine failure. The build still runs on those PRs (so bumps are validated) — only the deploy step is skipped.Verification
The deploy can't be fully verified until this merges to
main, since PR runs deploy to a preview environment rather than production. What this PR's own CI does confirm is the part that was broken: that the build completes on Node 22.22.2 instead of being rejected by Oryx.🤖 Generated with Claude Code