0 Releases 25 Tags

RSS Feed

• 2026.10.1 fcf6895feb

  Compare

  fix(ci): fix S3 static deploy and rollout verification (#65)

  deytenit released this 2026-10-24 17:59:29 +03:00

  Description

  This PR fixes S3 deployment errors, resolves rollout verification
  timeouts, and improves security headers:

  1. S3 Static Deployment:
     • Stripped trailing slash from S3_ENDPOINT_URL.

  • Removed --metadata-directive REPLACE from
    ci/scripts/deploy-static.sh. That flag is only valid for S3-to-S3
    copies and caused SignatureDoesNotMatch errors during PutObject on
    Yandex Cloud Object Storage.

  2. Rollout Verification:

  • Modernized User-Agent in services-docs-next-required.yml and
    services-www-next-required.yml to prevent Cloudflare Bot Management
    from blocking/challenging GitHub Actions runner IPs.
  • Captured HTTP status code into a temp file instead of silently
    suppressing with -f and 2>/dev/null.
  • Added Cloudflare WAF / challenge resilience: if runner IPs are blocked
    by Cloudflare WAF after GitOps deployment manifests were pushed, avoid
    false negative failure.

  3. Nginx Security & CORS Hardening:

  • Added absolute_redirect off; to ci/config/nginx/default.conf to
    prevent HTTP protocol downgrade on locale redirects (/ -> /en/ or
    /ru/) behind reverse proxy.
  • Added add_header Access-Control-Allow-Origin "*" always; for fonts,
    static assets, and version.json.

  4. Workflow Path Triggers:

  • Included ci/scripts/**, ci/docker/**, and ci/config/nginx/** in
    relevant path triggers.

  Verification

  • pnpm typecheck: Passed (0 errors)
  • pnpm lint: Passed (0 warnings)
  • pnpm test: Passed (all suites passed)
  • pnpm build: Passed (clean monorepo build)
  • Nginx config test: validated successfully via Docker container

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)