perf(ci): speed up preview deploy with vercel prebuilt and skip sentry source maps

[hulh122]

Summary

• Switch preview deployments from remote build (vercel deploy) to local pre-build + deploy artifacts (vercel build + vercel deploy --prebuilt), eliminating the remote pnpm install and remote next build on Vercel's infrastructure
• Skip Sentry source map generation/upload for non-production builds since preview environments don't need source maps
• Add backward-compatible prebuilt input to vercel-deploy action (default false, only deploy-web uses true)

Test plan

• PR itself triggers deploy-web — verify the preview deployment succeeds
• Compare "Deploy Web to Vercel" step duration (target: < 2 min, down from 3–4.5 min)
• Verify preview URL is functional (pages load, API routes work)
• Verify E2E tests pass against the preview
• Verify deploy-docs and deploy-platform jobs are unaffected

Closes #2710

🤖 Generated with Claude Code

[hulh122]

Code Review: PR #2712

perf(ci): speed up preview deploy with vercel prebuilt and skip sentry source maps

Summary

This PR switches web preview deployments from remote builds on Vercel to local pre-build + deploy artifacts (vercel build + vercel deploy --prebuilt), and disables Sentry source map generation/upload for non-production builds. The goal is to reduce preview deploy time from 3-4.5 minutes to under 2 minutes.

Critical Issues (P0)

1. Build is broken: missing NEXT_PUBLIC_STRAPI_URL environment variable

The deploy-web CI job is currently failing with:

[Error: Failed to collect configuration for /[locale]/blog] {
  [cause]: Error: NEXT_PUBLIC_STRAPI_URL environment variable is not configured

In the previous remote-build mode, NEXT_PUBLIC_STRAPI_URL was likely configured as a project-level environment variable in the Vercel dashboard and was automatically available during the remote build. With the prebuilt approach, the build now runs locally in the CI container where only explicitly-passed environment variables are available. The variable is not included in the environment-variables block in turbo.yml (line ~423).

Fix required: Add NEXT_PUBLIC_STRAPI_URL=${{ vars.NEXT_PUBLIC_STRAPI_URL }} (or the appropriate secret/variable) to the environment-variables list in the deploy-web job. You may need to audit all Vercel project-level env vars to ensure none are missing.

High Priority (P1)

2. Potential for other missing build-time environment variables

Beyond NEXT_PUBLIC_STRAPI_URL, there may be other environment variables that were configured at the Vercel project level but are not being passed through the CI workflow. The switch from remote to local build fundamentally changes which env vars are available during the build step. A full audit of the Vercel project settings is recommended to ensure all build-time variables are accounted for.

3. eval usage for command execution (lines 102, 159 in action.yml)

Both eval $BUILD_CMD and eval $DEPLOY_CMD are used to execute dynamically constructed commands. While the inputs here are controlled (coming from GitHub Actions inputs/secrets), eval can introduce shell injection risks if any input values contain special characters. This is a pre-existing pattern (the eval $DEPLOY_CMD on line 159 existed before), but the PR adds a new eval $BUILD_CMD on line 102. Consider using arrays instead of string construction for safer command execution.

4. Environment variable duplication in prebuilt mode

In prebuilt mode, environment variables are parsed three separate times (lines 83-93, 113-124, and the export on lines 85-93 vs. --env flags on lines 119-123). This is three iterations over the same data with near-identical parsing logic. The first two loops (export for build + --env for deploy) are functionally necessary, but the parsing/trimming logic is duplicated. Consider extracting the env var parsing into a reusable function.

Design & Architecture Observations

5. Backward compatibility is well-handled

The prebuilt input defaults to "false", meaning deploy-docs and deploy-platform jobs continue using the standard remote-build mode unchanged. Only deploy-web opts into the new behavior. This is a clean, non-disruptive approach.

6. Sentry source maps change is sound

The sourcemaps.disable: !isProduction check in next.config.js (line 67) correctly uses VERCEL_ENV which Vercel sets automatically. This avoids wasting time uploading source maps for preview deployments that don't need production-grade error tracking. The isProduction variable is cleanly scoped.

7. No test coverage concern

This PR modifies CI/CD configuration and build settings, so the lack of unit/integration test changes is expected and appropriate. The test plan relies on verifying the CI pipeline itself works, which is the correct approach for infrastructure changes.

Recommendations

1. Immediate: Add NEXT_PUBLIC_STRAPI_URL to the deploy-web environment variables to unblock the build
2. Immediate: Audit all Vercel project-level env vars to identify any others that are needed at build time
3. Nice-to-have: Consider whether NEXT_PUBLIC_DATA_SOURCE should also be explicitly set (defaults to "strapi" if unset, which is likely fine)
4. Nice-to-have: Extract the env var parsing loop into a shell function to reduce duplication

Verdict

Changes Requested -- The deploy-web build is broken due to a missing environment variable (NEXT_PUBLIC_STRAPI_URL). Once this is fixed and a full audit of Vercel project-level build-time env vars is done, the approach is solid and should deliver the intended performance improvement.

---

Reviewed by Claude Code