fix(ci): allow .zip in the preview-deploy artifact allowlist (unblock UI previews)

[JSONbored]

Why

Every UI Preview Deploy run has been failing — all recent runs failure — at the "Validate downloaded artifact" step:

##[error]Artifact contains unexpected file types — refusing to deploy:
./client/downloads/gittensory-extension.zip

The UI build emits a legitimately-served static asset, client/downloads/gittensory-extension.zip:

• generated by scripts/build-extension.mjs
• linked from apps/gittensory-ui/src/routes/extension.tsx (/downloads/gittensory-extension.zip)
• asserted 200 application/zip by scripts/smoke-production.mjs

…but zip was missing from the validation step's extension allowlist, so validation rejected the bundle and the deploy aborted before createDeployment. With no preview Deployment / environment_url ever recorded, Reviewbot's before/after table stays stuck on "Rendering preview…" for every UI PR (e.g. #635) — the after screenshot can never fill in.

What

Add zip to the allowlist regex in the validate step. One line.

-            -not -iregex '.*\.(mjs|js|...|md|csv|wgsl|glb|gltf)$' \
+            -not -iregex '.*\.(mjs|js|...|md|csv|zip|wgsl|glb|gltf)$' \

Security

The allowlist is the fork-PR defense (the build runs possibly-fork code; the deploy must not smuggle executables in). A .zip here is a passive download asset — wrangler versions upload only uploads it as a static asset; it is never executed by the worker (fork code only ever runs inside the isolated workers.dev preview when the URL is visited). So allowing .zip is the same risk class as the .wasm / binary fonts already permitted — no meaningful change to the boundary.

Effect

Once merged, UI preview deploys succeed again, the deployment_status → Reviewbot re-review path records the environment_url, and the stuck "after" screenshots fill in automatically. No Reviewbot change is required for this part (a companion Reviewbot PR separately makes a failed deploy show a terminal card instead of an eternal spinner).

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#653 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[ghost]

gittensory · advisory review

Reviewed 1 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR updates the CI workflow to allow .zip files in the preview‑deploy artifact allowlist, adding a comment and extending the regex. The change is minimal, well‑documented, and does not affect application code or public‑facing content.

Suggestions

• Consider adding a brief note in the workflow README about why .zip is now permitted, to aid future maintainers.
• If possible, ensure that any generated zip files are vetted (e.g., only contain expected extension assets) to avoid unintentionally distributing unwanted binaries.

Worth double-checking

• Allowing zip files could expose users to downloadable binaries; confirm that only intended zip assets are produced by the build.
• Make sure downstream consumers treat the zip as a passive download and do not execute its contents.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR adds 'zip' to the allowlist of file extensions in the UI preview-deploy CI workflow to permit serving the extension zip file as a static asset. The change is minimal, well-commented, and justified as a passive asset that poses no execution risk. It unblocks UI previews by allowing a necessary build output.

No blocking issues spotted.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.