chore(ci): no more pull_request_target

[avivkeller]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nodejs-org	Ready	Preview	Jul 6, 2026 8:37pm

[cursor]

PR Summary

Medium Risk
Workflow architecture and token/comment paths change in security-sensitive CI; misconfiguration could break PR comments or Chromatic until verified on fork and same-repo PRs.

Overview
CI security and PR feedback move off pull_request_target for Chromatic and Lighthouse, and PR comments are no longer posted from those untrusted runs.

Lighthouse and the new Compare Bundle Size job in build.yml only upload a pr-comment artifact (body + tag). A new Leave Comment workflow_run workflow downloads that artifact and posts or updates the PR comment via thollander/actions-comment-pull-request, including fork PRs by resolving the PR number when workflow_run does not link one. The standalone bundle-compare.yml workflow is removed; comparison runs in the same Build workflow on PRs, with base stats fetched via gh run list on the base SHA.

Bundle size reporting now uses Next/Turbopack route-bundle-stats.json instead of webpack-stats.json, and compare-size/index.mjs compares per-route first load JS rather than webpack asset lists.

Chromatic triggers on pull_request (no label requirement), bumps chromaui/action to v18, and reads CHROMATIC_PROJECT_TOKEN from vars instead of secrets.

^{Reviewed by Cursor Bugbot for commit 6a95094. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.41%. Comparing base (b75ea02) to head (6a95094).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8992   +/-   ##
=======================================
  Coverage   75.41%   75.41%           
=======================================
  Files          98       98           
  Lines        8636     8636           
  Branches      318      318           
=======================================
  Hits         6513     6513           
  Misses       2119     2119           
  Partials        4        4           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[Copilot]

Pull request overview

This PR removes usage of the privileged pull_request_target trigger in CI workflows and replaces direct PR-commenting with a safer two-workflow pattern: untrusted pull_request workflows serialize comment data into an artifact, and a trusted workflow_run workflow posts the comment after completion.

Changes:

• Switch Lighthouse and Chromatic workflows from pull_request_target to pull_request and adjust permissions/commenting behavior accordingly.
• Add a new Leave Comment workflow that downloads a pr-comment artifact on workflow_run completion and posts it to the PR.
• Replace the standalone bundle-compare workflow_run workflow by integrating bundle comparison into the main Build workflow and emitting a pr-comment artifact.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
.github/workflows/lighthouse.yml	Runs Lighthouse in pull_request context and uploads a pr-comment artifact instead of commenting directly.
.github/workflows/leave-comment.yml	New trusted workflow_run workflow intended to post PR comments based on downloaded artifacts.
.github/workflows/chromatic.yml	Moves Chromatic to pull_request and changes how the Chromatic token is sourced.
.github/workflows/bundle-compare.yml	Removes the old standalone bundle compare workflow_run workflow.
.github/workflows/build.yml	Adds an in-workflow bundle size comparison job and uploads pr-comment artifacts for trusted commenting.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[avivkeller]

Not sure why Next.js didn't generate the stats file... maybe something changed?

[avivkeller]

Looks like TURBOPACK_STATS is broken, and has been for some time. @MattIPv4 It's not really idiomatic, but I'm going to update this PR to also fix this.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 827ce1d. Configure here.}