Repository navigation
[No QA] Add a Cloudflare Worker that serves the web build with Workers Static Assets - #103501
Conversation
Standalone npm package (not a root workspace) so wrangler and workerd stay out of the root install. Root ESLint and Knip skip it because its types live in its own node_modules.
font-src uses 'self' instead of a hard-coded host, so the same policy works on localhost and test hostnames.
Missing static files return 404 instead of the SPA shell, hashed assets are cached as immutable, and HTML is never revalidated because its CSP nonce changes per request.
HTML responses never carry ETag or Last-Modified, so browsers have no validator to send for them.
Runs the real wrangler.jsonc in workerd via wrangler's createTestHarness against a fixture build, using node:test so the package needs no test-runner dependency.
The asset router 307-redirects paths like /a/[email protected] to its own percent-encoding. Looking assets up with that encoding keeps the URL the user opened.
Diffs status, caching and security headers (CSP per directive, nonces masked) between two hosts, e.g. production and a local wrangler dev session.
Covers running the Worker in workerd with wrangler dev against a real web build, the automated and manual checks, and what can only be verified on a deployed hostname.
The Worker is a standalone package that root typecheck and tests do not cover. The job needs no secrets, so it is safe on fork PRs.
CI installs Node from the root .nvmrc, so an exact engines pin here would fail npm ci on every Node upgrade.
wrangler dev and wrangler deploy now run scripts/prepareDist.sh themselves, so a deploy cannot upload source maps or Brotli twins by skipping a manual step.
The Worker runs for every asset request, so logging every request would far exceed the included Workers Logs volume.
Node's fetch replaces Sec-Fetch-Mode with the request mode, so the tests never sent a navigation. Miniflare restores MF-Sec-Fetch-Mode as Sec-Fetch-Mode before the Worker runs.
…shes Covers the .<10 hex>. naming scheme and files that must not be cached as immutable, the navigation exception to the missing-file 404, and checks every inline script in web/index.html without a nonce against the CSP hashes.
wrangler types also runs the build command, and CI has no dist/. Without one, dev and deploy still fail on the missing assets directory.
The fixture files were named like build output, which made it look as though compiled assets were committed. The harness now writes the same files into its temporary directory.
The staging environment is reserved for staging.new.expensify.com, so it has no route until the switchover. test-staging serves a staging build with the staging CSP on its own Worker.
The file has no extension, so a miss fell through to the SPA shell and was then served as application/json.
The tests check its inline scripts against the CSP hashes, so an edit there needs them to run.
Node's fetch overwrites Sec-Fetch-Mode, so the script's navigation checks reached a local Worker as ordinary requests.
A rebuild deletes dist/.assetsignore, so prepare-dist has to run again. Release archives now download to /tmp so they can't be committed.
Runs alongside the S3 deploy with a token that can only edit the test-staging Worker. continue-on-error keeps a failure there from failing the staging deploy.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@NicolasBonet Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button] |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c917dcef08
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (HASHED_ASSET_PATH.test(url.pathname)) { | ||
| response.headers.set('Cache-Control', 'public, max-age=31536000, immutable'); | ||
| } |
There was a problem hiding this comment.
When an old tab requests a hashed chunk absent from the current deployment, the asset binding returns the non-HTML 404 exercised in tests/worker.test.ts:149-155, but this unconditional pathname check still assigns that error max-age=31536000, immutable. The browser can retain the negative response for a year, so rolling back or otherwise reintroducing that same content-hashed asset will not recover for affected clients; apply the immutable policy only to successful asset responses.
Useful? React with 👍 / 👎.
|
Looks like Rory and Cole are actually OOO so I'm going to merge this. |
|
🚧 justinpersaud has triggered a test Expensify/App build. You can view the workflow run here. |
|
🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
|
|
✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release. |
|
🚀 Deployed to staging by https://github.com/justinpersaud in version: 9.5.9-0 🚀
|
|
🚀 Deployed to production by https://github.com/cristipaval in version: 9.5.9-4 🚀
Bundle Size Analysis (Sentry): |
4 participants
Explanation of Change
Moving the app deployment/build into Cloudlare Static Workers from Cloudfront S3.
This is handling that and deploying it to a new subdomain so we can test it out.
Fixed Issues
For https://github.com/Expensify/Expensify/issues/688126
PROPOSAL:
Tests
I deployed this to https://test-staging.new.expensify.com
Offline tests
npm run dev -- --local-protocol httpsrunning, loadhttps://localhost:8787/once so the service worker activates.QA Steps
// TODO: These must be filled out, or the issue title must include "[No QA]."
No QA. Nothing is deployed and the web app is still built and served the same way.
PR Author Checklist
### Fixed Issuessection aboveTestssectionOffline stepssectionQA stepssectionAvatar, I verified the components usingAvatarare working as expected)StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))npm run compress-svg)Avataris modified, I verified thatAvataris working as expected in all cases)Designlabel and/or tagged@Expensify/designso the design team can review the changes.mainbranch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTeststeps.Screenshots/Videos
Android: Native
Android: mWeb Chrome
iOS: Native
iOS: mWeb Safari
MacOS: Chrome / Safari