chore: add github sponsors on supporters

[bjohansebas]

Description

Note that there’s no REST API for GitHub Sponsors, only a GraphQL API. I’m still working on this.

Preview:

Validation

Related Issues

closes #8199

Check List

• I have read the Contributing Guidelines and made commit messages that follow the guideline.
• I have run pnpm format to ensure the code follows the style guide.
• I have run pnpm test to check if all tests are passing.
• I have run pnpm build to check if the website builds without errors.
• I've covered new added functionality with unit tests if necessary.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nodejs-org	Ready	Preview	May 15, 2026 3:33pm

[github-actions]

👋 Codeowner Review Request

The following codeowners have been identified for the changed files:

Team reviewers: @nodejs/nodejs-website

Please review the changes when you have a chance. Thank you! 🙏

[github-actions]

📦 Build Size Comparison

Summary

Metric	Value
Old Total Size	3.51 MB
New Total Size	3.51 MB
Delta	5.00 B (0.00%)

Changes

➕ Added Assets (2)

Name	Size
.next/static/chunks/4ab402c4ccfd82ec.js	41.55 KB
.next/static/chunks/9683dd9e3611b206.js	197.63 KB

➖ Removed Assets (2)

Name	Size
.next/static/chunks/46deeb46308b8a8b.js	41.54 KB
.next/static/chunks/3a4ee3cc36de6c5f.js	197.63 KB

[bjohansebas]

@nodejs/web-infra I think the new environment variable should also be set in Vercel, since that’s where the website is built, both for production and for previews

[Copilot]

Pull request overview

Adds GitHub Sponsors as an additional data source for the “Supporters” section, alongside OpenCollective, by updating the data generator and wiring the UI/docs to the new combined dataset.

Changes:

• Add GitHub Sponsors supporter type and update the Supporters UI to use a unified url field.
• Add GitHub GraphQL endpoint constant and implement GitHub Sponsors GraphQL fetching + shuffling in the supporters data generator.
• Update partners/supporters copy to mention GitHub Sponsors.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
apps/site/types/supporters.ts	Introduces a GitHub sponsors supporter type alias.
apps/site/pages/en/about/partners.mdx	Updates “Supporters” copy to include GitHub Sponsors.
apps/site/next.constants.mjs	Adds GitHub GraphQL API endpoint constant.
apps/site/next-data/generators/supportersData.mjs	Expands generator to fetch/merge OpenCollective + GitHub Sponsors and shuffle results.
apps/site/components/Common/Supporters/index.tsx	Updates list rendering to use url (and support both sources).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MattIPv4]

X-posting from Slack... the fine-grained token I generated did not work:

[{"type":"FORBIDDEN","path":["organization"],"extensions":{"saml_failure":false},"locations":[{"line":3,"column":5}],"message":"The 'Node.js' enterprise forbids access via a fine-grained personal access tokens if the token's lifetime is greater than 366 days. Please adjust your token's lifetime at the following URL: https://github.com/settings/personal-access-tokens/13409736"}]

I attempted switching the preview to a classic token with no permissions set, which also did not work:

[{"type":"INSUFFICIENT_SCOPES","locations":[{"line":6,"column":11}],"message":"Your token has not been granted the required scopes to execute this query. The 'id' field requires one of the following scopes: ['read:user', 'read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":17,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'databaseId' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":18,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'name' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":19,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'login' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":20,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'avatarUrl' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":21,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'url' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":22,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'websiteUrl' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":25,"column":11}],"message":"Your token has not been granted the required scopes to execute this query. The 'timestamp' field requires one of the following scopes: ['read:user', 'read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":27,"column":13}],"message":"Your token has not been granted the required scopes to execute this query. The 'monthlyPriceInDollars' field requires one of the following scopes: ['read:user', 'read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":28,"column":13}],"message":"Your token has not been granted the required scopes to execute this query. The 'isOneTime' field requires one of the following scopes: ['read:user', 'read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."}]

Given our security posture for this project is that anyone can submit a PR that will immediately be built on Vercel, anyone could extract this token, so I do not believe it is safe to grant read:user or read:org to this token, as this can access non-public information.

We could attempt using a fine-grained token that has an expiration date, to comply with the org requirement (even though the fine-grained token resource owner is not the org), but that then becomes a yearly maintenance burden for us to ensure it is regenerated before it expires and breaks this feature.

I feel like we may be at an impasse here, unless we want to try a classic token with those permissions, but production only, so that this feature will not work in preview deployments?

[MattIPv4]

I have generated a new classic token for @openjs-vercel with just the read:org permission (this does include potential access to private information). As this contains more than just public access, this token is now only set in the Vercel production environment, and specifically for preview deployments of this branch only -- however, importantly, other preview deployments will not have access to the token and this feature will not work for them.

With that scope applied to the token, https://nodejs-org-git-githubsponsors-openjs.vercel.app/en/about/partners is showing sponsors 🎉

[bjohansebas]

Cool, so @nodejs/nodejs-website and @nodejs/web-infra, could you please review it?

[bmuenzenmeyer]

one clarifying point between a comment and a query
otherwise looks great!

[bmuenzenmeyer]

@nodejs/nodejs-website any final comments on this?

[mikeesto]

It would be good to see this land. I noticed there's at least one supporter with no avatar or url, so I'm unsure if there is much benefit in displaying these cases?

[bmuenzenmeyer]

It would be good to see this land. I noticed there's at least one supporter with no avatar or url, so I'm unsure if there is much benefit in displaying these cases?

I found one data display gap in d32eb79 but there may be more, let's see what the preview holds...mine was only in OC

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d2d73ef. Configure here.}