Repository navigation
Conversation
This was referenced Oct 23, 2026
Merged
mithro
force-pushed
the
redirects-list
branch
from
October 24, 2026 07:29
a842b36 to
cd98541
Compare
mithro
force-pushed
the
redirects-sync-hooks
branch
from
October 24, 2026 07:30
e120ac7 to
844875a
Compare
mithro
force-pushed
the
redirects-list
branch
from
October 24, 2026 08:21
cd98541 to
2f635ec
Compare
mithro
force-pushed
the
redirects-sync-hooks
branch
from
October 24, 2026 08:21
844875a to
be4d74e
Compare
mithro
force-pushed
the
redirects-sync-hooks
branch
from
October 24, 2026 09:26
be4d74e to
7144867
Compare
|
📋 Previous verification results (archived) Click to view archived verification results from 2026-10-24T09:36:29.000Z❌ Preview Site Verification FAILEDPreview Site Verification ReportPR: #158 1. Basic Connectivity ✅
2. Content Verification
3. Multi-Page Asset VerificationDiscovering all pages in the site...
4. Link and Asset Verification (muffet)Running comprehensive muffet validation...
Summary: 0 Linked sites with invalid TLS certificates (warning only):
5. Performance Check
6. Mobile Responsiveness
Summary❌ Some verification checks failed 🔍 Automated verification • Run ID: 40081961911 • 2026-10-24T09:36:28.982Z ⏰ This verification result has been archived by Run ID: 40083862082 • A newer verification is available below |
mithro
force-pushed
the
redirects-sync-hooks
branch
from
October 24, 2026 09:55
7144867 to
a5c36dc
Compare
|
📋 Previous verification results (archived) Click to view archived verification results from 2026-10-24T10:02:46.000Z❌ Preview Site Verification FAILEDPreview Site Verification ReportPR: #158 1. Basic Connectivity ✅
2. Content Verification
3. Multi-Page Asset VerificationDiscovering all pages in the site...
4. Link and Asset Verification (muffet)Running comprehensive muffet validation...
Summary: 0 Linked sites with invalid TLS certificates (warning only):
5. Performance Check
6. Mobile Responsiveness
Summary❌ Some verification checks failed 🔍 Automated verification • Run ID: 40083862082 • 2026-10-24T10:02:45.592Z ⏰ This verification result has been archived by Run ID: 40084778281 • A newer verification is available below |
|
| Status | Preview URL | Issue |
|---|---|---|
| 🟡 Partial | View Preview | Git commit hash verification failed - deployment may be outdated |
The preview has been deployed but content verification is incomplete. The site may still be propagating or there may be loading issues.
Manual verification recommended: https://preview.wafer.space/pr-158/
⚡ Deployed to custom domain • Preview will be removed when PR is closed
|
📋 Previous verification results (archived) Click to view archived verification results from 2026-10-24T10:15:22.000Z❌ Preview Site Verification FAILEDPreview Site Verification ReportPR: #158 1. Basic Connectivity ✅
2. Content Verification
3. Multi-Page Asset VerificationDiscovering all pages in the site...
4. Link and Asset Verification (muffet)Running comprehensive muffet validation...
Summary: 0 Linked sites with invalid TLS certificates (warning only):
5. Performance Check
6. Mobile Responsiveness
Summary❌ Some verification checks failed 🔍 Automated verification • Run ID: 40084778281 • 2026-10-24T10:15:22.173Z ⏰ This verification result has been archived by Run ID: 40090626325 • A newer verification is available below |
|
| Status | Preview URL | Issue |
|---|---|---|
| 🟡 Partial | View Preview | Git commit hash verification failed - deployment may be outdated |
The preview has been deployed but content verification is incomplete. The site may still be propagating or there may be loading issues.
Manual verification recommended: https://preview.wafer.space/pr-158/
⚡ Deployed to custom domain • Preview will be removed when PR is closed
mithro
changed the title
|
| Status | Preview URL | Issue |
|---|---|---|
| 🟡 Partial | View Preview | Git commit hash verification failed - deployment may be outdated |
The preview has been deployed but content verification is incomplete. The site may still be propagating or there may be loading issues.
Manual verification recommended: https://preview.wafer.space/pr-158/
⚡ Deployed to custom domain • Preview will be removed when PR is closed
|
📋 Previous verification results (archived) Click to view archived verification results from 2026-10-24T11:43:58.000Z❌ Preview Site Verification FAILEDPreview Site Verification ReportPR: #158 1. Basic Connectivity ✅
2. Content Verification
3. Multi-Page Asset VerificationDiscovering all pages in the site...
4. Link and Asset Verification (muffet)Running comprehensive muffet validation...
Summary: 0 Linked sites with invalid TLS certificates (warning only):
5. Performance Check
6. Mobile Responsiveness
Summary❌ Some verification checks failed 🔍 Automated verification • Run ID: 40090626325 • 2026-10-24T11:43:58.434Z ⏰ This verification result has been archived by Run ID: 40249599356 • A newer verification is available below |
It reads the revision from a redirects.json's first item and asks the Worker to load exactly that one, retrying while Pages still serves an older file, another bulk operation is pending, or the write hasn't finished, since the Worker itself doesn't retry. A newer revision already loaded counts as success. It skips quietly when the Worker's URL or secret isn't available, as on fork PRs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018aHXTpnku3VjT9FFpoBEuy
The production deploy asks for the revision it built once Pages has it; preview deploys and preview cleanups ask for the preview list they pushed. Preview syncs don't fail their job, since the Worker's cron trigger catches up. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018aHXTpnku3VjT9FFpoBEuy
The Worker now returns the revision it reads back from the list after writing. Another sync's older write can land just after this one's, so a 200 whose list revision is older than the one requested is retried like a 409. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018aHXTpnku3VjT9FFpoBEuy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018aHXTpnku3VjT9FFpoBEuy
Until the list holds the deployed revision or a newer one, the client checks GET /list, waits while GET /source shows the site doesn't serve it yet, and otherwise calls POST /sync, backing off between rounds. Checking /list after each sync also catches another sync's older write landing just after this one's. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018aHXTpnku3VjT9FFpoBEuy
Cloudflare's Browser Integrity Check answers urllib's default User-Agent (Python-urllib/3.x) with HTTP 403 "error code: 1010", so every call the sync step made to the Worker failed until it gave up after 10 minutes. The Worker's own check is now reached: a wrong secret gets its 401. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018aHXTpnku3VjT9FFpoBEuy
From an independent review of this PR: - A POST /sync answering 200 sent the loop straight back to GET /list, past the deadline check and the sleep. The Worker answers 200 when it loads nothing, too, which happens while Pages still serves /sync's own fetch an older copy than /source saw, so the client could spin with no pause and no end. /sync's answer now says what the list holds; the client stops if that's our revision or newer, and otherwise waits like any other unfinished round. - Only URLError and TimeoutError were caught, so a dropped connection (RemoteDisconnected), a reset or a truncated read crashed it without a retry. All connection-level failures are retried now, and so is an answer that isn't a JSON object. - urllib follows redirects and sends the Authorization header on to wherever they point, on any host. Redirects are refused (and stop the sync) and REDIRECTS_SYNC_URL must be https. - The deadline only bounded the waits: each request could take 120 s. A request now gets at most 30 s and never more than the time left, and the last round is made at the deadline instead of giving up before it. - --require-secrets fails rather than skips without the URL or secret, for production, where a missing secret would otherwise go unnoticed. - The revision item must name exactly the list's host, as the Worker requires, so a file for the other list is refused at once. --from-file can't be combined with --number/--commit, --commit must be a full hash, and a file that can't be read is reported on stderr, as stdout may be $GITHUB_OUTPUT. Tests run the client against a local stand-in for the Worker, with a fake clock, and a new Script tests workflow runs them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018aHXTpnku3VjT9FFpoBEuy
Production: the sync was a step in the deploy job, after deploy-pages. Re-running that job after a failed sync would publish this run's site again, over any newer deploy, and the sync would then pass because the list already held the newer revision. It's now a sync-redirects job after deploy, so a re-run only syncs. The "pages" concurrency group moves from the workflow to the deploy job, so a slow sync doesn't hold up the next deploy. Reading the revision no longer stops a build: if it fails, the site still deploys and sync-redirects reports it. The sync passes --require-secrets. Previews: the sync step ran before the deployment status and the PR comment, holding them up for as long as 10 minutes when the Worker was down. It now runs last, and only where the branch has the script, as branches from before it get this workflow file but their own checkout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018aHXTpnku3VjT9FFpoBEuy
mithro
force-pushed
the
redirects-sync-hooks
branch
from
October 26, 2026 00:29
698f648 to
88ce0c3
Compare
|
| Status | Preview URL | Issue |
|---|---|---|
| 🟡 Partial | View Preview | Git commit hash verification failed - deployment may be outdated |
The preview has been deployed but content verification is incomplete. The site may still be propagating or there may be loading issues.
Manual verification recommended: https://preview.wafer.space/pr-158/
⚡ Deployed to custom domain • Preview will be removed when PR is closed
✅ Preview Site Verification PASSEDPreview Site Verification ReportPR: #158 1. Basic Connectivity ✅
2. Content Verification
3. Multi-Page Asset VerificationDiscovering all pages in the site...
4. Link and Asset Verification (muffet)Running comprehensive muffet validation...
5. Performance Check
6. Mobile Responsiveness
Summary✅ All verification checks passed! 🔍 Automated verification • Run ID: 40249599356 • 2026-10-26T00:39:56.139Z |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Site-side half of the Cloudflare redirects sync. The redirects sync Worker loads
https://wafer.space/redirects.json(written by #157) andhttps://preview.wafer.space/redirects.json(written by #162) into Cloudflare Bulk Redirect lists, on a 5-minute cron. This PR calls the Worker straight after each deploy and preview cleanup, so a new list applies within a minute or two of the file being served, not after the next cron.The Worker has three endpoints:
GET /source(the revision of the file the site serves),GET /list(the revision the list holds) andPOST /sync(load the file if it's newer, answering with what the list then holds)..github/scripts/redirects-sync.py --list … --from-file redirects.json(or--number/--commit) repeats until the list holds that revision or a newer one: checkGET /list; wait whileGET /sourceshows the site doesn't serve it yet (Pages publishing delay, caches); otherwisePOST /sync, and stop if its answer shows the list at that revision or newer.--timeout(10 minutes). Each request gets at most 30 s and never more than the time left, and the last round is made at the deadline.REDIRECTS_SYNC_URL, which must behttps://.REDIRECTS_SYNC_URL/REDIRECTS_SYNC_SECRET: it skips, as on fork PRs; with--require-secretsit fails instead.jekyll.yml).sync-redirectsjob afterdeploysyncswafer_spacewith--require-secrets, and fails the run if it can't, as the site is then live with stale redirects until the cron loads them.pagesconcurrency group moves onto thedeployjob, so a slow sync doesn't hold up the next deploy.pr-preview.ymlandcleanup-previews.ymlsyncpreview_wafer_spacewith theredirects.jsonthey pushed, without failing their jobs, since the cron catches up. Inpr-preview.ymlit runs after the deployment status and PR comment, and only on branches that have the script.Testing
.github/scripts/test_redirects_sync.pyruns the client against a local stand-in for the Worker with a fake clock, and the new Script tests workflow runs it. It covers:/syncthat loads nothing: it waits rather than spinning;698f648: the client waited while Pages served the previous file (revision 500), thenPOST /syncansweredappliedwith the list at 513, and it stopped on that answer. An earlier deploy caught the User-Agent problem: 403 "error code: 1010" on every call.--print-revisionreads today'swafer.spaceandpreview.wafer.spacefiles with their own list and refuses each with the other's.83f53f9and698f648. It also noted that one secret serves both lists and that same-repo PR authors can read it. That can't inject redirects, as the Worker only loads each site's own file, and those authors already get the preview and theme deploy keys.Setup
Done: the Worker runs at
https://redirects.wafer-space.workers.dev, and this repository has the variableREDIRECTS_SYNC_URLand secretREDIRECTS_SYNC_SECRET(set by the Worker repository'sscripts/setup.py).🤖 Generated with Claude Code
https://claude.ai/code/session_018aHXTpnku3VjT9FFpoBEuy