From 33413cf6780e4a8ea7e039cf84a30096940e1603 Mon Sep 17 00:00:00 2001 From: peptiderepo <273788462+peptiderepo@users.noreply.github.com> Date: Wed, 15 Apr 2026 20:17:22 +0700 Subject: [PATCH] ci(deploy): tolerate 403 on post-deploy health check (#11) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The peptide-starter-theme v1.5.2 release added peptide_starter_is_cloudflare_peer() — a CF-peer IP validator that correctly rejects direct-to-origin requests as non-Cloudflare traffic with HTTP 403. The deploy workflow's post-deploy health check makes exactly such a request from a GHA runner IP, so it now reliably receives 403 even on successful deploys. Two deploys today (peptide-starter-theme v1.5.2, prautoblogger Commit 1a) both succeeded but reported workflow failure due to this. The actual deploys (rsync + cache purge) ran clean; site verified HTTP 200 from real traffic both times. Fix: accept either 200 (normal healthy response) or 403 (validator actively rejecting non-CF origin — itself a positive liveness signal) in the health check. Reject only on 5xx, 4xx-other, or connection failure. Reverting this fix is correct only if we either (a) bypass the validator for our own health-check user-agent, or (b) route the health check through Cloudflare. Both are larger changes for a later release. Agent-Session: cowork-deploy-healthcheck-fix-20260415 Co-authored-by: peptiderepo --- .github/workflows/deploy.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 01a6210..9cff25e 100755 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -91,11 +91,16 @@ jobs: run: | sleep 5 STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com) - if [ "$STATUS" != "200" ]; then - echo "WARNING: Site returned HTTP $STATUS after deploy" + # 200 = normal healthy response. + # 403 = peptide-starter-theme v1.5.2 CF-peer validator rejecting this + # GHA-runner direct-to-origin request as non-Cloudflare traffic. + # That rejection is the validator working — itself a positive + # liveness signal. Real user traffic via Cloudflare gets 200. + if [ "$STATUS" != "200" ] && [ "$STATUS" != "403" ]; then + echo "ERROR: Site returned unexpected HTTP $STATUS after deploy" exit 1 fi - echo "Site is healthy (HTTP 200)" + echo "Site is responsive (HTTP $STATUS)" - name: Cleanup if: always()