fix(ci): unblock @next/swc, lockfile-keyed node_modules, per-image runner sizing

[waleedlatif1]

Summary

Three CI fixes, all traced to real telemetry rather than guesswork.

1. The @next/swc-* binaries were blocked by the supply-chain age gate

Every Build App run logged:

⚠ Mismatching @next/swc version, detected: 16.2.6 while Next.js is on 16.2.11

16.2.6 appears nowhere in bun.lock or any package.json, so CI was compiling production bundles with an SWC binary the lockfile does not reference.

Root cause: #5890 bumped next 16.2.6 → 16.2.11 for the July 2026 security advisories and added next + @next/env to minimumReleaseAgeExcludes so they could install — but not the @next/swc-* platform binaries, which ship in lockstep with next and were published the same day. They stayed blocked by the 7-day gate, so bun install has been silently installing no compiler at all since that bump (they are optional deps, so the failure is silent). Reproduced directly: adding @next/swc-linux-x64-gnu@16.2.11 errored published within minimum release age of 604800 seconds; with the exclude added it resolves.

Fix, in two parts (the first alone is not enough — verified by a CI run that still tried to download the compiler):

1. Add the four @next/swc-* binaries to minimumReleaseAgeExcludes, alongside the next entry that should have carried them.
2. Declare them as root optionalDependencies so they get resolved entries in bun.lock. Without an entry, bun install --frozen-lockfile cannot install a package at all — next's inline optional-dependency metadata is not sufficient. Each package carries os/cpu constraints, so only the matching one installs per platform; the lockfile records all four.

1b. node_modules sticky disk was shared across branches

The disk was keyed only on github.event_name, so every branch shared one mutable node_modules volume. A sticky disk is a persistent mutable volume, not a content-addressed cache, and bun install --frozen-lockfile adds what the lockfile needs without pruning what it dropped — so the pre-bump 16.2.6 binary survived on the shared disk and was served to every 16.2.11 build. That is why the missing-compiler bug above stayed hidden: the stale disk was masking it.

Fix: add the bun.lock hash to that key. The bun download cache and Turbo cache are content/hash-addressed and stay shared, which keeps a fresh node_modules disk cheap to fill.

Note these two are coupled: fixing the cache key alone gives a clean disk with no SWC binary, at which point next tries to download one at build time and dies on registry detection. Both fixes are required together.

2. Per-image Blacksmith runner sizing (bs_runner)

All three Docker matrices pinned every image to 8 vCPU on Blacksmith, even though the existing gh_runner column already documents that only the app image needs a big runner. The non-app builds idle at 12–15% CPU and under 10% memory. Added a bs_runner field mirroring gh_runner so the sizing lives with the image and can't drift back: app 8 vCPU, migrations 2, realtime 4, PII 4 (same for ARM). Also dropped docs-embeddings 8 → 2 vCPU — it's network-bound on the embeddings API at ~9% CPU.

3. Cold-build memory warning

Running out of RAM kills the whole VM and surfaces only as The runner has received a shutdown signal — no mention of memory, after ~12 minutes of work. That's what made the OOM fixed in #5944 hard to diagnose. The build job now reports MemTotal up front and emits a ::warning:: with the real numbers when the runner is under 40 GB. Warning-only on purpose: warm builds peak ~12 GB and partial ~28 GB, so a 32 GB runner still completes many builds, and hard-failing them would degrade the break-glass GitHub path rather than protect it.

This also addresses the P1 left open on #5944: the GitHub fallback (linux-x64-8-core, 32 GB) is still below the ~51 GB cold peak. Rather than guess a larger label — hosted-runners reports total_count: 0 for the org, so no GitHub larger runners appear provisioned, and an unresolvable runs-on label queues forever — the preflight turns that path into an immediate, explanatory failure on any provider.

Not included: .next/cache

The ~5 GB Turbopack FS cache shares the same event+fork key, but keying it on the lockfile would be redundant: NEXT_TURBOPACK_BUILD_CACHE already hashes on config/deps/module content, so a lockfile bump invalidates those slices on its own. The way that cache could be corrupted was a mismatched compiler writing entries into it — which fix 1 removes at the source.

Type of Change

• Bug fix (CI correctness + reliability + cost)

Testing

Tested manually — all three workflows parse; preflight verified under bash -n; every matrix referencing bs_runner defines it on all 12 entries.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 24, 2026 11:09pm

[cursor]

PR Summary

Low Risk
Changes are limited to CI workflows, Bun install config, and lockfile optional deps; no runtime app logic or auth/data paths.

Overview
Fixes CI so Next.js 16.2.11 builds use the matching @next/swc compiler instead of a missing or stale binary. The supply-chain age gate excluded the platform SWC packages while next was allowlisted; root optionalDependencies plus bunfig excludes and bun.lock entries make bun install --frozen-lockfile install the compiler in CI.

Sticky node_modules disks in test/build now include hashFiles('bun.lock') so branches with different lockfiles no longer share one mutable volume (which had been masking the SWC mismatch).

Docker image build matrices gain bs_runner per image on Blacksmith (app 8 vCPU, migrations 2, realtime/PII 4; ARM uses a similar split). Docs embeddings drops from 8 to 2 vCPU. The app build job adds a memory headroom step that warns when the runner has under 40 GB, to surface likely OOM kills that only show as runner shutdown.

^{Reviewed by Cursor Bugbot for commit 5a43163. Configure here.}

[greptile-apps]

Greptile Summary

This PR improves CI dependency correctness, cache isolation, runner sizing, and build diagnostics.

• Adds pinned platform-specific Next.js SWC binaries to the root optional dependencies, Bun lockfile, and release-age exclusions.
• Keys persistent node_modules volumes by the Bun lockfile hash.
• Selects Blacksmith runner sizes per Docker image and reduces the network-bound documentation embeddings runner size.
• Replaces the Build App memory gate with a warning-only diagnostic so the GitHub fallback can continue when warm or partial builds fit.

Confidence Score: 5/5

The PR appears safe to merge, with the previously reported GitHub fallback failure corrected by making the memory check warning-only.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/test-build.yml	Isolates dependency volumes by lockfile and safely changes the runner-memory preflight from a hard gate to a diagnostic warning.
.github/workflows/ci.yml	Moves Blacksmith runner selection into each Docker matrix entry to support per-image sizing.
.github/workflows/docs-embeddings.yml	Reduces the runner allocated to the network-bound documentation embeddings job.
package.json	Declares pinned platform-specific SWC binaries as root optional dependencies.
bun.lock	Records all four platform-specific SWC packages with their operating-system and CPU constraints.
bunfig.toml	Exempts the pinned SWC binaries from the temporary minimum-release-age gate alongside Next.js.

_{Reviews (5): Last reviewed commit: "docs(ci): explain ARM runner sizing rati..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a86b189. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2efc5ed. Configure here.}

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5a43163. Configure here.}