ci: give the Website preview verification a Vercel automation bypass - #974
Merged
Conversation
The "Verify Website preview runtime embedding policy" step added in #963 cannot pass. Vercel deployment protection answers every preview path with 302 -> vercel.com/sso-api, so Playwright drives the browser to an SSO page and times out waiting for the app: locator.click: Test timeout of 30000ms exceeded. waiting for [data-cockpit-desktop-navigation] button "Settings" It has never succeeded: skipped on 738b2ed as stale, failed on its first real execution. Because the step sits mid-deploy, its failure skips Website promotion, the cockpit redirect build and cockpit promotion — production has not advanced since the arc landed, which is why cockpit.threadplane.ai still answers 200 where the smoke suite expects 308. Send the project's automation bypass when CI supplies it. The header is added only when VERCEL_AUTOMATION_BYPASS_SECRET is set, so local and production runs are unchanged, and every URL this suite visits is a first-party origin. The step now fails with an actionable message rather than a silent 90s timeout when the secret is missing. Requires the repository secret VERCEL_AUTOMATION_BYPASS_SECRET, from "Protection Bypass for Automation" on the Vercel website project. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
Contributor
Contributor
This was referenced Sep 3, 2026
blove
added a commit
that referenced
this pull request
Sep 3, 2026
…tomation bypass (#984) With #983 the deploy job reached "Exhaustively verify immutable cockpit preview" for the first time, and it failed on its first probe: [preview] root default redirect: expected 308, received 302. The 302 is Vercel deployment protection sending every path on the unaliased artifact to vercel.com/sso-api — the same wall #974 removed for the Website preview. Bypass secrets are issued per Vercel project, so the Website secret cannot open the cockpit deployment. - deploy-smoke.ts sends `x-vercel-protection-bypass` on every probe when VERCEL_AUTOMATION_BYPASS_SECRET is set, read from the environment so the value never lands in argv or step logs. A 302 to the SSO endpoint now names deployment protection and the missing secret instead of reporting a bare status mismatch. - The workflow step supplies the secret from VERCEL_COCKPIT_AUTOMATION_BYPASS_SECRET and fails with a provisioning message when it is unset. - Unit tests cover the header on every probe (including the hostile-header case), its absence without a secret, and the SSO hint; the workflow guard asserts both preview checks carry their own project's secret. Requires the repository secret VERCEL_COCKPIT_AUTOMATION_BYPASS_SECRET. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
Verify Website preview runtime embedding policystep added in #963 cannot pass. Vercel deployment protection answers every preview path with302 -> vercel.com/sso-api, so Playwright drives the browser to an SSO page and times out waiting for the app:It has never succeeded — skipped on
738b2ed8as stale, failed on its first real execution (26ec7e99).Why this matters
The step sits mid-way through the deploy job, so its failure skips everything after it: Website promotion, the cockpit redirect build, and cockpit promotion. Production has not advanced since the control-plane arc landed. That is why
cockpit.threadplane.aistill answers200where the smoke suite expects308— the Cockpit retirement shipped tomainbut never reached production.Change
Send the project's automation bypass when CI supplies it. The header is added only when
VERCEL_AUTOMATION_BYPASS_SECRETis set, so local runs and production runs are unchanged, and every URL this suite visits is a first-party Threadplane origin.The step also now fails with an actionable message instead of a silent 90-second timeout when the secret is missing.
Adds two regression tests to
playwright-config.spec.ts:import.meta, which is what silently broke it in feat: unify docs and runtime control plane #963 (comments stripped first, so the prose warning doesn't trip the guard).Before merging
Create the secret, or this step will fail loudly on
main:VERCEL_AUTOMATION_BYPASS_SECRET.The step only runs on push to
main, so this PR's own CI will be green either way.Verification
createWebsitePlaywrightConfig({})→ noextraHTTPHeaders; with the secret → both headers set. Covered by tests.import.metaguard by reintroducingimport.meta.url— it fails as intended.ci-workflow.spec.mjs: 33/33.🤖 Generated with Claude Code