From 42731c8ad14b5c894518ea18531f4272b99af7a4 Mon Sep 17 00:00:00 2001 From: JSONbored <49853598+JSONbored@users.noreply.github.com> Date: Sat, 13 Jun 2026 15:01:39 -0700 Subject: [PATCH] fix(ci): allow .zip in the preview-deploy artifact allowlist MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The UI build emits a served static asset, client/downloads/gittensory-extension.zip (generated by scripts/build-extension.mjs; linked from the extension route; asserted 200 by smoke-production.mjs). The "Validate downloaded artifact" step's extension allowlist omitted `zip`, so it rejected the bundle and EVERY UI Preview Deploy failed at validation: ##[error]Artifact contains unexpected file types — refusing to deploy: ./client/downloads/gittensory-extension.zip Because the deploy aborted before createDeployment, no preview Deployment/environment_url was ever recorded, so Reviewbot's before/after table stayed stuck on "Rendering preview…" for every UI PR (e.g. #635). A .zip here is a passive download asset wrangler only uploads (never executes), so adding it to the allowlist doesn't weaken the fork-PR defense — same risk class as the wasm/font binaries already permitted. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ui-preview-deploy.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ui-preview-deploy.yml b/.github/workflows/ui-preview-deploy.yml index dc0fe3d7ca..abd46ae96a 100644 --- a/.github/workflows/ui-preview-deploy.yml +++ b/.github/workflows/ui-preview-deploy.yml @@ -99,8 +99,10 @@ jobs: test -d client || { echo "::error::artifact missing client/ assets dir"; exit 1; } # 3) Allowlist file extensions — fail on anything that isn't a normal web/build output (blocks # smuggled scripts/binaries). A few extensionless CF asset files are explicitly permitted. + # `zip` covers the served downloads (e.g. /downloads/gittensory-extension.zip) — a passive + # static asset wrangler only uploads (never executes), so allowing it doesn't run fork code. unexpected="$(find . -regextype posix-extended -type f \ - -not -iregex '.*\.(mjs|js|cjs|map|json|css|html?|txt|svg|png|jpe?g|gif|webp|avif|ico|bmp|woff2?|ttf|otf|eot|wasm|xml|webmanifest|md|csv|wgsl|glb|gltf)$' \ + -not -iregex '.*\.(mjs|js|cjs|map|json|css|html?|txt|svg|png|jpe?g|gif|webp|avif|ico|bmp|woff2?|ttf|otf|eot|wasm|xml|webmanifest|md|csv|zip|wgsl|glb|gltf)$' \ -not -name '_headers' -not -name '_redirects' -not -name '_routes.json' -not -name '.assetsignore')" if [ -n "$unexpected" ]; then echo "::error::Artifact contains unexpected file types — refusing to deploy:"