Change const owner = 'peptiderepo' → 'peptide-repo' in deploy-health.yml.
This fixes the GitHub API owner ref after the user→org migration so the
monitor correctly queries repos under the peptide-repo org.
All uses:/repository: refs across the estate were already updated at migration
time — this was the sole remaining owner slug ref.
Agent-Session: claude/org-ref-fix-20260617
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
The write-only security check in 08-pr-vision-admin.spec.ts asserted
page.content() does not contain 'sk-or-'. The password input for the
API key renders with placeholder="sk-or-…" (an ellipsis format hint
shown when the key is admin-managed). This placeholder contains the
literal string 'sk-or-' so the naive toContain assertion trips even
though value="" and no real key is in the page.
Fix: replace toContain('sk-or-') with toMatch(/sk-or-v1-[A-Za-z0-9]{20,}/).
A real OpenRouter key uses the format 'sk-or-v1-<20+ alnum chars>';
the placeholder ellipsis 'sk-or-…' never matches this pattern, so the
false-positive is eliminated. The assertion still catches any real key
accidentally rendered in server-side HTML.
The value="" assertion is unchanged and continues to guard the core
write-only invariant independently.
Agent-Session: fix-smoke-key-assertion-20260617
Co-authored-by: peptiderepo <bot@peptiderepo.com>
OS deps are pre-installed on the self-hosted peptide-vps runner host.
--with-deps invokes apt-get which fails under the runner's NoNewPrivileges
sandbox hardening. Flag was already dropped in e00f777; this adds an
inline comment so the intent is self-documenting for future maintainers.
Agent-Session: smoke-no-withdeps-20260617
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
Drop --with-deps from npx playwright install chromium. The peptide-vps runner has OS deps pre-installed; --with-deps invokes apt-get blocked by NoNewPrivileges hardening. Binary-only install verified for ghrunner via SSH.
Agent-Session: smoke-playwright-nodeps-20260617
Reusable workflow uses: refs do not follow GitHub transfer redirects.
Update owner string from peptiderepo to peptide-repo post org-migration.
Agent-Session: fix-e2e-ref-20260617
Shared pipeline deploy-staging + deploy-production (deploy-app.yml) and the Playwright staging smoke (smoke.yml) now run on the org self-hosted runner [self-hosted, peptide-vps] from the VPS stable IP, fixing the Hostinger rotating-runner-IP throttle. CI/validate stay GitHub-hosted. v1.7.1.
QA: APPROVE-WITH-P2-NOTES (2026-06-17-e6f6b67); P2 = pre-existing stale peptiderepo/ owner refs (work via redirect, ref-cleanup batch).
Agent-Session: deploy-self-hosted-20260617
Skip-if-absent Playwright spec for the board New Article / Generate Now control; now live with prautoblogger v0.21.0. Gates future deploys.
Agent-Session: m4-generate-now-smoke-20260614
Merged ahead of the v0.19.3 dossier fix so staging smoke gates it.
QA: APPROVE qa-reviews/peptide-e2e/2026-06-12-0c5c301.md (re-head after conflict resolution)
Agent-Session: cto-dossier-403-hotfix-20260612
Guards the submenu-before-parent 404 class in the deploy gate.
QA: APPROVE-W-P2 qa-reviews/peptide-e2e/2026-06-12-113bb17.md
Agent-Session: cto-board-404-hotfix-merge-20260612
Hostinger rate-limits GitHub runner IPs on wp-login.php, causing
TimeoutError (30s) during the auth setup step. This has produced 6
deploy-gate failures over 2 days across multiple repos.
Changes:
- Raise navigation timeout from 30s to 90s per attempt
- Wrap the full login sequence in a retry loop (up to 3 attempts)
- Create a fresh BrowserContext per attempt so stale cookies / throttle
state cannot carry over between retries
- Wait 15s between attempts to let transient throttle windows clear
- Log each attempt number and outcome clearly (console.log + console.error)
so any future failure is diagnosable from the CI log without a local repro
- On final failure, surface a hint pointing to the Hostinger throttle cause
Assertion behaviour: unchanged. The #wpadminbar check and storageState
write are identical to before — retries only affect getting past wp-login.
No changes to smoke test assertions, playwright.config.ts, or workflow files.
Agent-Session: e2e-login-flake-20260612
deploy-production now needs smoke; a smoke FAILURE blocks prod while a skipped
smoke (run_smoke:false) still allows it. Automated functional gate replacing
the removed human approval gate — hands-off but safe.
Agent-Session: cto gate-smoke
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
The peptide CPT menu was restructured (no top-level 'Peptides' label), so the
text=Peptides assertion failed. Assert the CPT's admin link by href
(a[href*='post_type=peptide']) and toBeAttached — robust to label changes and
submenu (hidden-until-hover) placement.
Agent-Session: cto smoke-green
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
- 02 search: target the visible .hero-search instance; the old .first()
selector matched the hidden header search-overlay (instance 1).
- 01 calculator: it auto-computes from the peptide preset; select the peptide
and assert #prc-results, scoped to .prc-calculator (the old broad
button[type=submit] selector clicked the PSA search button).
- 03 admin: 'const nav' had been swallowed into a comment (ReferenceError).
- 04 rest-api: PSA /search returns {results:[]} with no 'status' key; drop it.
Auth fixed separately via a dedicated staging CI admin (ci-smoke) + corrected
STAGING_WP_ADMIN_* secrets; the global.setup failure was cascading into these.
Agent-Session: cto smoke-green
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
Compare prod-deployment SHA to main and ignore changes confined to .github/,
tests/, and docs/build files (which the deploy excludes) — so infra-only commits
don't trip a false 'prod behind main' alert every day.
Agent-Session: cto monitor-drift-filter
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
* ci(deploy): retry rsync on Hostinger runner-IP throttle + best-effort inventory guard
Pilot surfaced an exit-255 SSH connection timeout (documented Hostinger
rate-limiting of concurrent runner IPs). rsync now retries 4x/25s; the plugin
count guard is best-effort so a throttled check can't fail a good deploy.
Agent-Session: cto harden-deploy
* ci: add daily Deploy Health Monitor (drift + deploy-failure)
Scheduled GitHub Actions check (runs on GitHub infra, not the dead local cron):
for each app repo, compares the latest production deployment SHA to main and
flags failed deploy runs. Opens one de-duplicated 'deploy-health' issue when
something is off — the alarm that was missing when deploys silently broke.
Agent-Session: cto deploy-health-monitor
---------
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
Single staging→smoke→production pipeline callable by every plugin/theme repo
via workflow_call. Replaces six copy-pasted per-repo deploy.yml files so deploy
logic is fixed once. Includes the pre/post active-plugin-count guard, LiteSpeed
purge, and health checks. Callers pass target_path + secrets: inherit.
Agent-Session: cto reusable-deploy
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
- 01 calculator: page lives at /calculator/ (confirmed live), not
/reconstitution-calculator/ — the 404 failed all 3 calc tests.
- 00 homepage: brand title is 'Peptide Repo' (with space); regex /peptiderepo/i
never matched. Broadened to /peptide ?repo/i.
- 03 admin: required-plugin slug is 'prautoblogger' (WP dir), not 'pr-autoblogger'.
These were test bugs, not site regressions — the site serves all three correctly.
Agent-Session: cto smoke-triage
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
Third bug in the smoke-gate chain. With testDir + GH-Secrets fixes already in place, this unblocks the workflow-driven prod deploy.
Agent-Session: cto merge-peptide-e2e-post-login-fix
When smoke.yml runs via workflow_call from another repo (peptide-repo-core,
peptide-starter-theme, etc.), GitHub Actions checks out the CALLER's repo
by default. The caller has no package-lock.json, so setup-node's npm cache
lookup fails with 'Some specified paths were not resolved'.
Fix: add repository/ref to the checkout step so we always fetch peptide-e2e
regardless of who calls the workflow. This ensures npm ci and Playwright
have the correct test code and dependency lockfile.
03-admin-plugins.spec.ts and 04-rest-api.spec.ts were cut off mid-test,
causing Playwright TypeScript parse failures and the smoke gate to show
0 jobs. Added the missing test bodies, assertions, and closing braces.
New tests added:
- PR Core Settings page loads (03)
- Peptide CPT verified via /wp-json/wp/v2/types/peptide (04)
Fixes smoke gate for all future deploys.
