[pull] canary from vercel:canary

.github/actions/sccache/action.yml

@@ -5,10 +5,6 @@ inputs:
     description: 'SCCACHE_BASE_DIR for path normalization (default: $GITHUB_WORKSPACE)'
     required: false
     default: ''
-  turbo-token:
-    description: 'Fallback TURBO_TOKEN if not set in environment (e.g. from secrets.TURBO_TOKEN)'
-    required: false
-    default: ''
 runs:
   using: 'node20'
   main: 'main.js'

.github/actions/sccache/start.sh

@@ -1,28 +1,23 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Normalize TURBO_API and TURBO_TOKEN: prefer environment values and
-# fall back to Vercel's public API and the secret passed as an action input.
+# Default TURBO_API to Vercel's public API when the workflow does not set it.
 if [ -z "${TURBO_API:-}" ]; then
   export TURBO_API="https://api.vercel.com"
   echo "TURBO_API=${TURBO_API}" >> "$GITHUB_ENV"
 fi
 
-if [ -z "${TURBO_TOKEN:-}" ]; then
-  if [ -n "${INPUT_TURBO_TOKEN:-}" ]; then
-    export TURBO_TOKEN="${INPUT_TURBO_TOKEN}"
-    echo "TURBO_TOKEN=${TURBO_TOKEN}" >> "$GITHUB_ENV"
-  else
-    echo "WARNING: no TURBO_TOKEN available"
-  fi
-fi
+# Exported by `vercel/setup-turborepo-remote-cache-action`, and unset entirely
+# when that step was skipped. Bind them so the substring expansions below don't
+# trip `set -u`, which rejects an unset name even in `${var:0:3}`.
+TURBO_TOKEN="${TURBO_TOKEN:-}"
+TURBO_TEAM="${TURBO_TEAM:-}"
 
-if [ -z "${TURBO_TEAM:-}" ]; then
-  export TURBO_TEAM="vtest314-next-adapter-e2e-tests"
-  echo "TURBO_TEAM=${TURBO_TEAM}" >> "$GITHUB_ENV"
+if [ -z "$TURBO_TOKEN" ]; then
+  echo "WARNING: no TURBO_TOKEN available"
 fi
 
-echo "::add-mask::${TURBO_TOKEN:-}"
+echo "::add-mask::${TURBO_TOKEN}"
 echo "Cache endpoint: ${TURBO_API:0:9}..."
 echo "TURBO_TOKEN: ${TURBO_TOKEN:0:3}..."
 echo "TURBO_TEAM: ${TURBO_TEAM}"

.github/workflows/build_and_deploy.yml

@@ -30,11 +30,10 @@ env:
   # --env-mode loose is a breaking change required with turbo 2.x since Strict mode is now the default
   # TODO: we should add the relevant envs later to to switch to strict mode
   TURBO_ARGS: '-v --env-mode loose --remote-cache-timeout 90 --summarize --log-order stream'
-  TURBO_TEAM: 'vtest314-next-adapter-e2e-tests'
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
   # Prefer shared remote cache across runs, but keep local cache enabled so jobs
   # degrade gracefully if the remote cache or token is unavailable.
   TURBO_CACHE: 'local:rw,remote:rw'
-  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
   # Without this environment variable, rust-lld will fail because some dependencies defaults to newer version of macOS by default.
   #
   # See https://doc.rust-lang.org/rustc/platform-support/apple-darwin.html#os-version for more details
@@ -136,12 +135,22 @@ jobs:
     runs-on: ubuntu-latest
     env:
       NEXT_TELEMETRY_DISABLED: 1
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 25
           persist-credentials: false
 
+      - name: Set up Turborepo remote cache
+        if: ${{ vars.TURBO_TEAM != '' }}
+        continue-on-error: true
+        uses: vercel/setup-turborepo-remote-cache-action@135046f5efcadb17337d9b29b8d5b4035ae64b10 # v1.0.0
+        with:
+          team: ${{ vars.TURBO_TEAM }}
+
       - name: Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -247,6 +256,9 @@ jobs:
     env:
       # Disable all build caches for production/staging/force-preview deploys
       NEXT_SKIP_BUILD_CACHE: ${{ contains(fromJSON('["production","staging","force-preview"]'), needs.deploy-target.outputs.value) && '1' || '' }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
       # Enable long paths on Windows to avoid MAX_PATH (260 char) errors
       # with deeply nested node_modules/.pnpm paths
@@ -263,6 +275,13 @@ jobs:
           fetch-depth: 100
           persist-credentials: false
 
+      - name: Set up Turborepo remote cache
+        if: ${{ vars.TURBO_TEAM != '' }}
+        continue-on-error: true
+        uses: vercel/setup-turborepo-remote-cache-action@135046f5efcadb17337d9b29b8d5b4035ae64b10 # v1.0.0
+        with:
+          team: ${{ vars.TURBO_TEAM }}
+
       - name: Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ !matrix.docker }}
@@ -480,11 +499,21 @@ jobs:
 
     runs-on: ubuntu-latest-16-core-oss
 
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
+      - name: Set up Turborepo remote cache
+        if: ${{ vars.TURBO_TEAM != '' }}
+        continue-on-error: true
+        uses: vercel/setup-turborepo-remote-cache-action@135046f5efcadb17337d9b29b8d5b4035ae64b10 # v1.0.0
+        with:
+          team: ${{ vars.TURBO_TEAM }}
+
       - name: Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: