From 043a6ee78afb5e6946916a711604f2dcc3dd4fb5 Mon Sep 17 00:00:00 2001 From: Randall Stillwell Date: Sun, 24 May 2026 16:14:59 -0500 Subject: [PATCH] fix(ci): drop x-vercel-set-bypass-cookie=true from wait-action path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The wait-action's healthcheck was still 401ing despite the bypass query being correct. Root cause: with `x-vercel-set-bypass-cookie=true`, Vercel returns 307 + Set-Cookie (`_vercel_jwt`), but axios in Node has no cookie jar — it follows the redirect to the bare URL without the cookie, which then 401s. Local verification (run by operator): curl -sI "https:///?x-vercel-protection-bypass=" | head -1 → HTTP/2 200 (works, no cookie needed) curl -sI "https:///?x-vercel-protection-bypass=&x-vercel-set-bypass-cookie=true" | head -1 → HTTP/2 307 (the redirect-without-cookie path that breaks axios) For a one-shot healthcheck, the per-request bypass query is enough. The cookie variant stays reserved for the future Playwright config (adopt-playwright-smoke) where a real browser cookie jar exists. Added an inline comment in preview-smoke.yml explaining this so the next agent doesn't accidentally re-add the cookie param. Co-authored-by: Cursor --- .github/workflows/preview-smoke.yml | 9 ++++++++- .github/workflows/visual-diff.yml | 3 ++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/preview-smoke.yml b/.github/workflows/preview-smoke.yml index 8226e9d..2f65fc8 100644 --- a/.github/workflows/preview-smoke.yml +++ b/.github/workflows/preview-smoke.yml @@ -75,7 +75,14 @@ jobs: with: token: ${{ secrets.GITHUB_TOKEN }} max_timeout: 120 - path: /?x-vercel-protection-bypass=${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}&x-vercel-set-bypass-cookie=true + # NOTE: do NOT add `&x-vercel-set-bypass-cookie=true` here. Vercel + # responds to that with a 307 + Set-Cookie (`_vercel_jwt`), but + # axios in Node has no cookie jar — the cookie is dropped before + # the followup request, which then 401s. For this one-shot + # healthcheck the bare bypass query is enough; the cookie variant + # belongs in the future Playwright config where the browser does + # have a cookie jar. + path: /?x-vercel-protection-bypass=${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }} - uses: actions/setup-node@v4 with: diff --git a/.github/workflows/visual-diff.yml b/.github/workflows/visual-diff.yml index 75e3578..f6771e9 100644 --- a/.github/workflows/visual-diff.yml +++ b/.github/workflows/visual-diff.yml @@ -67,7 +67,8 @@ jobs: with: token: ${{ secrets.GITHUB_TOKEN }} max_timeout: 120 - path: /?x-vercel-protection-bypass=${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}&x-vercel-set-bypass-cookie=true + # See preview-smoke.yml for the no-`set-bypass-cookie` rationale. + path: /?x-vercel-protection-bypass=${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }} - uses: actions/setup-node@v4 with: