fix(ci): open the protected immutable cockpit preview with its own automation bypass - #984
Merged
Merged
Conversation
…tomation bypass With #983 the deploy job reached "Exhaustively verify immutable cockpit preview" for the first time, and it failed on its first probe: [preview] root default redirect: expected 308, received 302. The 302 is Vercel deployment protection sending every path on the unaliased artifact to vercel.com/sso-api — the same wall #974 removed for the Website preview. Bypass secrets are issued per Vercel project, so the Website secret cannot open the cockpit deployment. - deploy-smoke.ts sends `x-vercel-protection-bypass` on every probe when VERCEL_AUTOMATION_BYPASS_SECRET is set, read from the environment so the value never lands in argv or step logs. A 302 to the SSO endpoint now names deployment protection and the missing secret instead of reporting a bare status mismatch. - The workflow step supplies the secret from VERCEL_COCKPIT_AUTOMATION_BYPASS_SECRET and fails with a provisioning message when it is unset. - Unit tests cover the header on every probe (including the hostile-header case), its absence without a secret, and the SSO hint; the workflow guard asserts both preview checks carry their own project's secret. Requires the repository secret VERCEL_COCKPIT_AUTOMATION_BYPASS_SECRET. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
#983 let the deploy job reach Exhaustively verify immutable cockpit preview for the first time (run 33767685952). It failed on its first probe:
The 302 is Vercel deployment protection: every path on the unaliased cockpit artifact answers
302 -> vercel.com/sso-api, confirmed with a direct request. This is the same wall #974 removed for the Website preview. Bypass secrets are issued per Vercel project, soVERCEL_AUTOMATION_BYPASS_SECRET(threadplane) cannot open threadplane-cockpit.Seventh push-only failure path in this arc. The step is unreachable from PR CI, which is why it waited behind the other six.
Change
deploy-smoke.tssendsx-vercel-protection-bypasson every probe whenVERCEL_AUTOMATION_BYPASS_SECRETis set. The value is read from the environment, never argv, so it stays out of process listings and step logs. A 302 to the SSO endpoint now names deployment protection and the missing secret instead of a bare status mismatch.VERCEL_COCKPIT_AUTOMATION_BYPASS_SECRETand fails with a provisioning message when it is unset (the ci: give the Website preview verification a Vercel automation bypass #974 pattern).Before this can pass
VERCEL_COCKPIT_AUTOMATION_BYPASS_SECRET.Verification
deploy-smoke.spec.ts: 12/12.ci-workflow.spec.mjs: 38/38. Cockpit lint: 0 errors. YAML parses.expected 308, received 302. The deployment answered with Vercel deployment protection … supply the owning project's automation bypass secret via VERCEL_AUTOMATION_BYPASS_SECRET.dry-run:preview:https://cockpit.threadplane.ai:399.🤖 Generated with Claude Code