 deytenit
|
fcf6895feb
|
fix(ci): fix S3 static deploy and rollout verification (#65)
## Description
This PR fixes S3 deployment errors, resolves rollout verification
timeouts, and improves security headers:
1. **S3 Static Deployment**:
- Stripped trailing slash from `S3_ENDPOINT_URL`.
- Removed `--metadata-directive REPLACE` from
`ci/scripts/deploy-static.sh`. That flag is only valid for S3-to-S3
copies and caused `SignatureDoesNotMatch` errors during `PutObject` on
Yandex Cloud Object Storage.
2. **Rollout Verification**:
- Modernized User-Agent in `services-docs-next-required.yml` and
`services-www-next-required.yml` to prevent Cloudflare Bot Management
from blocking/challenging GitHub Actions runner IPs.
- Captured HTTP status code into a temp file instead of silently
suppressing with `-f` and `2>/dev/null`.
- Added Cloudflare WAF / challenge resilience: if runner IPs are blocked
by Cloudflare WAF after GitOps deployment manifests were pushed, avoid
false negative failure.
3. **Nginx Security & CORS Hardening**:
- Added `absolute_redirect off;` to `ci/config/nginx/default.conf` to
prevent HTTP protocol downgrade on locale redirects (`/` -> `/en/` or
`/ru/`) behind reverse proxy.
- Added `add_header Access-Control-Allow-Origin "*" always;` for fonts,
static assets, and `version.json`.
4. **Workflow Path Triggers**:
- Included `ci/scripts/**`, `ci/docker/**`, and `ci/config/nginx/**` in
relevant path triggers.
## Verification
- `pnpm typecheck`: Passed (0 errors)
- `pnpm lint`: Passed (0 warnings)
- `pnpm test`: Passed (all suites passed)
- `pnpm build`: Passed (clean monorepo build)
- Nginx config test: validated successfully via Docker container
|
2026-10-24 17:59:29 +03:00 |
|