ci: Attach Vercel build logs to Slack post on failures (#1956)

Fixing the GitHub action's filter to find the Vercel post in Slack, to
attach the build logs in Slack instead of PRs on a public repo, just in
case anything sensitive makes it way into the build, and out of the
logs.

Follow-up to #1946, found by re-triggering the build on #1948 after
merging #1946

## Tested

- Build failure logs posted in
[Slack](https://sourcegraph.slack.com/archives/C0C25K5RHRN/p1789188631974869?thread_ts=1789185584.403469&cid=C0C25K5RHRN)

- Build failure PR comment
#1948 (comment)
links to the Slack post, instead of posting build logs publicly

## Amp thread

- [Vercel build report security
review](https://ampcode.com/threads/T-01a093c3-a827-71ba-af20-c13e851c9a77)

---------

Co-authored-by: Amp <amp@ampcode.com>

Author: marcleblanc2

.github/workflows/vercel-build-report.yml

@@ -1,22 +1,24 @@
 name: Vercel build report
 
 # Vercel only shows build logs to members of its team. When a PR's Vercel
-# build fails, this comments the end of the build log on the PR, with the
-# full log as a workflow artifact when the comment cannot hold it all; when a
-# later revision builds, the comment is updated to say so and the artifact
-# is deleted. The full log is also attached to the Vercel Slack app's "failed
-# to deploy" post when the SLACK_BOT_TOKEN secret and SLACK_CHANNEL_ID
-# variable are set (see dev/slack-app-vercel-build-report.json).
+# build fails, this attaches the build log to the Vercel Slack app's "failed
+# to deploy" post (SLACK_BOT_TOKEN secret and SLACK_CHANNEL_ID variable; see
+# dev/slack-app-vercel-build-report.json) and comments a link to it on the
+# PR; when a later revision builds, the comment is updated to say so. The log
+# never goes on the PR itself, so anything sensitive a build prints stays in
+# Slack instead of a public repository.
 #
 # GitHub only delivers repository_dispatch (and finds workflow_dispatch
 # workflows) once the workflow file is on the default branch, so before merge
 # run dev/report-vercel-build.mjs locally instead. After merge, re-run on a PR
 # by hand with the same payload fields as inputs:
 #   gh workflow run vercel-build-report.yml \
-#       -f id=dpl_... -f state=error -f sha=<pr head sha>
+#       -f id=dpl_... -f state=failed -f sha=<pr head sha>
 on:
     repository_dispatch:
-        types: [vercel.deployment.error, vercel.deployment.success]
+        # A build that exits non-zero is `failed`; `error` is only sent for
+        # deleted deployments, which have no log
+        types: [vercel.deployment.failed, vercel.deployment.success]
     workflow_dispatch:
         inputs:
             id:
@@ -26,16 +28,14 @@ on:
                 description: Deployment state (client_payload.state.type)
                 required: true
                 type: choice
-                options: [error, success]
+                options: [failed, success]
             sha:
                 description: Full commit SHA of the PR head (client_payload.git.sha)
                 required: true
 
 permissions:
     contents: read
     pull-requests: write
-    # To delete the full-log artifact once the build passes
-    actions: write
 
 env:
     DEPLOYMENT_ID: ${{ github.event.client_payload.id || inputs.id }}
@@ -46,7 +46,12 @@ env:
 
 jobs:
     report:
-        if: github.event.client_payload.environment != 'production'
+        # `failed` is also sent for checks_failed, aliasing_failed and account
+        # problems, where the build log shows a build that passed
+        if: >-
+            github.event.client_payload.environment != 'production'
+            && (github.event.client_payload.state.type != 'failed'
+                || github.event.client_payload.state.detail == 'deployment_failed')
         runs-on: ubuntu-latest
         steps:
             - name: Check out dev/report-vercel-build.mjs
@@ -57,35 +62,26 @@ jobs:
 
             - name: Fetch the build log from Vercel
               # Vercel is only contacted when the build failed
-              if: env.DEPLOYMENT_STATE == 'error'
+              if: env.DEPLOYMENT_STATE == 'failed'
               id: log
               env:
                   # Scoped to the sourcegraph-docs project, so it needs no team ID
                   VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
               run: node dev/report-vercel-build.mjs fetch-log "$LOG_FILE"
 
-            - name: Attach the full log when the comment cannot hold it all
-              if: steps.log.outputs.truncated == 'true'
-              id: artifact
-              uses: actions/upload-artifact@v4
-              with:
-                  name: vercel-build-log-${{ env.COMMIT_SHA }}
-                  path: ${{ env.LOG_FILE }}
-                  retention-days: 30
-
-            - name: Comment on the pull request
-              env:
-                  PR_NUMBER: ${{ steps.log.outputs.pull_request }}
-                  ARTIFACT_ID: ${{ steps.artifact.outputs.artifact-id }}
-                  ARTIFACT_URL: ${{ steps.artifact.outputs.artifact-url }}
-              run: node dev/report-vercel-build.mjs comment "$LOG_FILE"
-
             - name: Attach the log to the Vercel app's Slack post
-              if: env.DEPLOYMENT_STATE == 'error'
-              # The PR comment is the record; a Slack problem must not fail it
+              if: env.DEPLOYMENT_STATE == 'failed'
+              id: slack
+              # The PR should still hear about the failure when Slack is down
               continue-on-error: true
               env:
                   PR_NUMBER: ${{ steps.log.outputs.pull_request }}
                   SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
                   SLACK_CHANNEL_ID: ${{ vars.SLACK_CHANNEL_ID }}
               run: node dev/report-vercel-build.mjs slack "$LOG_FILE"
+
+            - name: Comment on the pull request
+              env:
+                  PR_NUMBER: ${{ steps.log.outputs.pull_request }}
+                  SLACK_PERMALINK: ${{ steps.slack.outputs.permalink }}
+              run: node dev/report-vercel-build.mjs comment

AGENTS.md

@@ -9,7 +9,7 @@
 -   **Checks**: `npm run check` runs every `dev/check-*.mjs` (links, filenames, images); `npm run build` runs them first, so any finding fails a deploy
 -   **Check links**: `npm run check -- links --check-anchors --check-self-links` (CI comments on PRs that break links; see `dev/check-links.mjs`; the build runs it without flags, so only dead page links fail a deploy). When moving a page or renaming a heading, update every link to it; a redirect in `src/data/redirects.ts` does not satisfy the check. Link to this site with relative paths (`/admin/config/site-config`), never `https://sourcegraph.com/docs/…` or `https://docs.sourcegraph.com/…`. To also probe the external links you added: `npm run check -- links --check-anchors --check-self-links --check-external --diff <(git diff -U0 origin/main)`
 -   **Prove changed links resolve on a deploy**: `node dev/verify-links-live.mjs --site <vercel-preview-url>` prints a Markdown table for the PR description
--   **Vercel build failures**: Vercel shows build logs only to its team members, so `.github/workflows/vercel-build-report.yml` comments the log tail on the PR (see `dev/report-vercel-build.mjs`). It reads Vercel with the `VERCEL_TOKEN` repo secret, a token scoped to the `sourcegraph-docs` project that expires 2026-12-10; mint a new one with `POST /v3/user/tokens?teamId=<team>` and `projectId` in the body. It also attaches the full log to the Vercel Slack app's "failed to deploy" post in `#alerts-vercel-doc-site`, using the `SLACK_BOT_TOKEN` repo secret and `SLACK_CHANNEL_ID` repo variable. The bot is the Slack app in `dev/slack-app-vercel-build-report.json`; to recreate it, paste that manifest at <https://api.slack.com/apps?new_app=1> (From a manifest), install it, copy its Bot User OAuth Token into the secret, and `/invite @Vercel build log` to the channel
+-   **Vercel build failures**: Vercel shows build logs only to its team members, so `.github/workflows/vercel-build-report.yml` attaches the log to the Vercel Slack app's "failed to deploy" post in `#alerts-vercel-doc-site` and comments a link to it on the PR (see `dev/report-vercel-build.mjs`). The log itself never goes on the PR, since the repository is public. It reads Vercel with the `VERCEL_TOKEN` repo secret, a token scoped to the `sourcegraph-docs` project that expires 2026-12-10; mint a new one with `POST /v3/user/tokens?teamId=<team>` and `projectId` in the body. Slack needs the `SLACK_BOT_TOKEN` repo secret and `SLACK_CHANNEL_ID` repo variable. The bot is the Slack app in `dev/slack-app-vercel-build-report.json`; to recreate it, paste that manifest at <https://api.slack.com/apps?new_app=1> (From a manifest), install it, copy its Bot User OAuth Token into the secret, and `/invite @Vercel build log` to the channel
 
 ## AI Chat Integration