Preact: bundlesize not running on PR's

[developit]

@siddharthkp - any idea why that might be happening? Maybe we're on an old version?

[marvinhagemeister]

@developit Perhaps we are missing the github token?
https://github.com/siddharthkp/bundlesize#2-build-status

[siddharthkp]

Maybe we're on an old version?

Old but not too old

It seems to be running on developit/preact but not on forks (like siddharthkp/preact, because the forks don't have the travis secrets 😢

Even if you add the right secrets, it's not going to compare with the original repo 🤔

Not sure how other tools handle this, is there a tool I can take inspiration from?

[developit]

not sure! explanation makes sense though

[siddharthkp]

A quick and dirty workaround that I used was: Merge the pull request into a temporary branch first and then create another PR from that (all from GitHub website)

[ForsakenHarmony]

shouldn't it always take the secret from the repo being merged into?

[Kanaye]

Definitly not @ForsakenHarmony.
See the Travis Docs on env vars

Encrypted environment variables are not available to pull requests from forks due to the security risk of exposing such information to unknown code.

If this weren't the case, you could leek the private keys stored within the env just by submitting a PR with malicious code executed from travis.
For example I could modify the npm run-script to http post the secret keys to my own servers and do ... whatever those keys would allow me to do.

How are other projects handling this with bundlesize ?

[siddharthkp]

How are other projects handling this with bundlesize ?

@Kanaye they are not

[ForsakenHarmony]

@siddharthkp I'm not sure I really see the problem, bundlesize should have the secret because it's being merged into this repo?

[siddharthkp]

@ForsakenHarmony nah, as @kanaye pointed out:

Encrypted environment variables are not available to pull requests from forks due to the security risk of exposing such information to unknown code.

(even if it is being merged back to the original)

A quick and dirty workaround that I used was: Merge the pull request into a temporary branch first and then create another PR from that

[developit]

Update: we could just have our build job fail if the size is > 4kb. Ideally we'd run with a % delta from master, but that's hard to do in CI since its stateless.

[marvinhagemeister]

Closing, we switched to https://github.com/GoogleChromeLabs/travis-size-report