feat(ci): add webapp PR preview deploy workflow by macko911 · Pull Request #6191 · NangoHQ/nango

macko911 · 2026-05-20T12:21:50Z

Problem

No way to preview webapp (app.nango.dev) changes on open PRs without manually deploying to app-development.nango.dev, overwriting the shared dev environment.

Solution

Adds .github/workflows/preview-webapp.yml — on every PR open/push/reopen:

Posts a 🔄 Deploying comment immediately (updates in-place on re-runs, no duplicates)
Builds the webapp (npm run ts-build && npm run -w @nangohq/webapp build) with the development API_DOMAIN
Assumes the preview deploy role via OIDC (PREVIEW_APP_UI_ROLE) — uses the pull_request OIDC sub claim enabled by NangoHQ/nango-infra#124
Syncs packages/webapp/dist/ to s3://$PREVIEW_APP_UI_BUCKET/previews/pr-<number>/
Invalidates the CloudFront distribution and updates the comment to ✅ Ready or ❌ Failed

Preview URLs: https://pr-<number>.app-development.nango.dev

Depends on NangoHQ/nango-infra#124 being applied and the following GitHub Actions variables set in the development environment:

PREVIEW_APP_UI_BUCKET
PREVIEW_APP_UI_DISTRIBUTION_ID
PREVIEW_APP_UI_ROLE

Closes NAN-5648

Testing

Open a test PR and verify a single 🔄 Deploying comment appears immediately
Push another commit and verify the same comment is updated (no new comment)
Confirm https://pr-<number>.app-development.nango.dev loads the webapp once infra is applied

Fork PR security validation

Validated via #6231.

For pull_request jobs from forks, GitHub enforces two hard limits that cannot be overridden from within the workflow:

No OIDC token — the AWS credentials step cannot assume any role
Read-only GITHUB_TOKEN — even if the workflow requests pull-requests: write, GitHub caps fork PR jobs at read-only

Worth noting: for pull_request events, GitHub runs the workflow file from the fork's head — so a fork contributor could modify the workflow (e.g. remove the if guard). The if guard is therefore an efficiency measure to skip wasted CI builds, not a security boundary. The two limits above are enforced by GitHub regardless of workflow content.

Scenario	Outcome
Fork PR, `if` guard present	Skipped
Fork PR, `if` guard removed	Failed at "Configure AWS credentials" — `Credentials could not be loaded from any providers`

linear · 2026-05-20T12:21:54Z

NAN-5648

github-actions · 2026-05-20T12:22:10Z

Preview Deploy

Status	URL	Deploy Logs	Last Updated
✅ Ready	https://pr-6191.app-development.nango.dev	Deploy Logs	Mon, 25 May 2026 06:42:25 GMT

cubic-dev-ai

1 issue found across 1 file

Confidence score: 4/5

This PR is likely safe to merge with minimal risk: the reported issue is moderate (5/10) and appears limited to CI comment behavior rather than application runtime functionality.
In .github/workflows/preview-webapp.yml, only checking part of the comment history before posting can create duplicate preview marker comments on long-lived PRs, which may add noise and confusion in review threads.
Pay close attention to .github/workflows/preview-webapp.yml - ensure the workflow searches all comment pages before deciding whether to create a new marker comment.

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

superagent-security

Superagent found 5 security concern(s).

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3da8e38051

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

superagent-security

Superagent found 5 security concern(s).

superagent-security

Superagent found 2 security concern(s).

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 997f53c1f4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

superagent-security

Superagent found 2 security concern(s).

cubic-dev-ai · 2026-05-25T08:36:31Z

You're iterating quickly on this pull request. To help protect your rate limits, cubic has paused automatic reviews on new pushes for now—when you're ready for another review, comment @cubic-dev-ai review.

superagent-security

Superagent found 2 security concern(s).

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 57aa42d9f2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

superagent-security

Superagent found 2 security concern(s).

macko911 had a problem deploying to development May 20, 2026 12:21 — with GitHub Actions Failure

cubic-dev-ai Bot reviewed May 20, 2026

View reviewed changes

Comment thread .github/workflows/preview-webapp.yml Outdated

macko911 had a problem deploying to development May 20, 2026 12:29 — with GitHub Actions Failure

macko911 force-pushed the matej/nan-5648-preview-webapp-workflow branch from 204082a to 29f3e21 Compare May 22, 2026 12:33

macko911 temporarily deployed to development May 22, 2026 12:59 — with GitHub Actions Inactive

macko911 temporarily deployed to development May 22, 2026 13:31 — with GitHub Actions Inactive

cubic-dev-ai Bot reviewed May 22, 2026

View reviewed changes

Comment thread packages/server/lib/routes.private.ts Outdated

macko911 marked this pull request as ready for review May 22, 2026 14:11

superagent-security Bot added contributor:verified Contributor passed trust analysis. pr:flagged PR flagged for review by security analysis. labels May 22, 2026

superagent-security Bot reviewed May 22, 2026

View reviewed changes

Comment thread packages/server/lib/routes.private.ts

chatgpt-codex-connector Bot reviewed May 22, 2026

View reviewed changes

Comment thread packages/server/lib/routes.private.ts Outdated

macko911 temporarily deployed to development May 22, 2026 14:28 — with GitHub Actions Inactive

superagent-security Bot reviewed May 22, 2026

View reviewed changes

Comment thread packages/server/lib/routes.private.ts

superagent-security Bot reviewed May 22, 2026

View reviewed changes

Comment thread .github/workflows/preview-webapp.yml

Comment thread packages/server/lib/routes.private.ts Outdated

Comment thread .github/workflows/preview-webapp.yml Outdated

Comment thread .github/workflows/preview-webapp.yml

Comment thread .github/workflows/preview-webapp.yml

superagent-security Bot reviewed May 22, 2026

View reviewed changes

Comment thread packages/server/lib/routes.private.ts Outdated

macko911 temporarily deployed to development May 22, 2026 14:33 — with GitHub Actions Inactive

macko911 commented May 22, 2026

View reviewed changes

Comment thread .github/workflows/preview-webapp.yml

macko911 commented May 22, 2026

View reviewed changes

Comment thread .github/workflows/preview-webapp.yml Outdated

macko911 commented May 22, 2026

View reviewed changes

Comment thread .github/workflows/preview-webapp.yml

macko911 commented May 22, 2026

View reviewed changes

Comment thread .github/workflows/preview-webapp.yml

superagent-security Bot added pr:verified PR passed security analysis. and removed pr:flagged PR flagged for review by security analysis. labels May 22, 2026

superagent-security Bot reviewed May 22, 2026

View reviewed changes

Comment thread packages/server/lib/routes.private.ts Outdated

chatgpt-codex-connector Bot reviewed May 22, 2026

View reviewed changes

Comment thread packages/server/lib/routes.private.ts Outdated

Comment thread .github/workflows/preview-webapp.yml

macko911 temporarily deployed to development May 22, 2026 14:41 — with GitHub Actions Inactive

macko911 commented May 22, 2026

View reviewed changes

Comment thread packages/server/lib/routes.private.ts Outdated

superagent-security Bot removed the pr:verified PR passed security analysis. label May 22, 2026

macko911 commented May 25, 2026

View reviewed changes

Comment thread .github/workflows/preview-webapp.yml

macko911 commented May 25, 2026

View reviewed changes

Comment thread packages/server/lib/utils/cors.ts

marcindobry approved these changes May 25, 2026

View reviewed changes

ci(workflow): skip fork PRs in preview deploy

a510e06

superagent-security Bot added pr:flagged PR flagged for review by security analysis. and removed pr:verified PR passed security analysis. labels May 25, 2026

superagent-security Bot reviewed May 25, 2026

View reviewed changes

macko911 added 4 commits May 25, 2026 10:32

test: trigger preview workflow from fork

9381ba7

test: trigger preview workflow from fork

650c0e1

test: remove fork guard to validate OIDC failure

06d37db

revert: remove test commits from fork validation

57aa42d

superagent-security Bot reviewed May 25, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed May 25, 2026

View reviewed changes

Comment thread .github/workflows/preview-webapp.yml

superagent-security Bot added pr:verified PR passed security analysis. and removed pr:flagged PR flagged for review by security analysis. labels May 25, 2026

macko911 enabled auto-merge May 25, 2026 09:37

macko911 disabled auto-merge May 25, 2026 09:37

macko911 added this pull request to the merge queue May 25, 2026

macko911 removed this pull request from the merge queue due to a manual request May 25, 2026

ci: trigger fresh CI run

0c980c6

superagent-security Bot added pr:flagged PR flagged for review by security analysis. and removed pr:verified PR passed security analysis. labels May 25, 2026

superagent-security Bot reviewed May 25, 2026

View reviewed changes

Comment thread .github/workflows/preview-webapp.yml

Comment thread packages/server/lib/utils/cors.ts

superagent-security Bot added pr:verified PR passed security analysis. and removed pr:flagged PR flagged for review by security analysis. labels May 25, 2026

macko911 added this pull request to the merge queue May 25, 2026

Merged via the queue into master with commit 39cf1ff May 25, 2026
27 checks passed

macko911 deleted the matej/nan-5648-preview-webapp-workflow branch May 25, 2026 12:30

Conversation

macko911 commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Testing

Fork PR security validation

Uh oh!

linear Bot commented May 20, 2026

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preview Deploy

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

superagent-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

superagent-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

superagent-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

superagent-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot commented May 25, 2026

Uh oh!

superagent-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

superagent-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

macko911 commented May 20, 2026 •

edited

Loading

github-actions Bot commented May 20, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading