AI_Assistant/pcbjam
Watch
1
0
Fork
You've already forked pcbjam
 0
Code Issues Pull requests Projects Releases 4 Packages Wiki Activity Actions 2

fix(deploy/site): stop 08 failing the cutover over two miscalibrated checks

Browse source 
Both fired on a healthy production cutover and told the operator to roll
back, which is worse than not checking at all.

- The DNS check looked for a CNAME on www. Once the custom domain is
  attached the record is PROXIED, so it answers with Cloudflare anycast A
  records and exposes no CNAME — the empty result was the correct state
  being reported as "unexpected target". Now it asserts what actually
  matters: the host resolves, and it does not still CNAME to Vercel. The
  authoritative on-Cloudflare signal was already the cf-ray/x-vercel-id
  pair right below it.

- HSTS absence was a hard FAIL. It is an independent one-toggle choice with
  no bearing on whether the migration worked, so it is a WARN unless
  EXPECT_HSTS=1. Set that once the zone toggle is on and it becomes a hard
  assertion again.

Verified against the real cutover: 21 probes, 20 pass, 1 warn (HSTS), 0 fail.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LAmkjM7okPdScp9XLW1JVr
This commit is contained in:
Viktor Vaczi 2026-07-27 14:50:34 +02:00
commit c61ec8aa0c
2 changed files with 24 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

21
deploy/site/08-verify-prod.sh
View file

@ -15,13 +15,20 @@ require_cmd curl dig jq awk sed
rc=0
section "DNS now resolves to Cloudflare"
www_cname="$(dig +short CNAME "www.$ZONE_NAME" || true)"
echo " www CNAME: ${www_cname:-<none>}"
case "$www_cname" in
*pages.dev*) echo " PASS points at Pages" ;;
*vercel-dns*) echo " FAIL still points at Vercel — DNS has not propagated (or the swap did not run)"; rc=1 ;;
*) echo " WARN unexpected target" ;;
esac
# A PROXIED record answers with Cloudflare anycast A records and exposes no CNAME,
# so an empty CNAME lookup here is the expected result once the custom domain is
# attached — not a problem. What would be wrong is failing to resolve at all, or
# still CNAMEing to Vercel. The authoritative "are we on Cloudflare" check is the
# cf-ray / x-vercel-id pair below.
for h in "$ZONE_NAME" "www.$ZONE_NAME"; do
a="$(dig +short A "$h" | tr '\n' ' ')"
c="$(dig +short CNAME "$h" | tr '\n' ' ')"
printf ' %-20s A=%s%s\n' "$h" "${a:-<none>}" "${c:+ CNAME=$c}"
if [ -z "$a" ]; then echo " FAIL $h does not resolve"; rc=1; fi
case "$c" in
*vercel-dns*) echo " FAIL $h still CNAMEs to Vercel — not propagated, or the attach did not happen"; rc=1 ;;
esac
done
section "we are actually being served by Cloudflare, not a stale Vercel cache"
h="$(_headers "$PROD_BASE/")"

12
deploy/site/lib/parity.sh
View file

@ -241,11 +241,19 @@ assert_parity() {
# 6) prod-only
if [ "$_scope" = prod ]; then
# HSTS is a deliberate, independent choice — one zone toggle, unrelated to
# whether the migration worked. Absent is a WARN, not a FAIL: failing here
# would tell an operator to roll back a healthy cutover. Set EXPECT_HSTS=1
# once you have enabled it, and it becomes a hard assertion.
_hsts="$(_hdr "$(_headers "$_base/")" strict-transport-security)"
case "$_hsts" in
*max-age=63072000*) pass hsts - "$_hsts" ;;
"") fail hsts - "absent (Vercel sent max-age=63072000)" ;;
*) soft hsts - "$_hsts (differs from the Vercel baseline)" ;;
"") if [ "${EXPECT_HSTS:-0}" = 1 ]; then
fail hsts - "absent, but EXPECT_HSTS=1"
else
soft hsts - "absent (Vercel sent max-age=63072000) — enable it in SSL/TLS -> Edge Certificates, then set EXPECT_HSTS=1"
fi ;;
*) soft hsts - "$_hsts (differs from the Vercel baseline max-age=63072000)" ;;
esac
fi