jcoffey-dev
e8b6a8bc2e
web/nginx.conf ended its try_files chain in an unconditional /200.html, so every path the site does not have -- /wp-login.php, /.env, a typo'd inbound link -- came back as the SPA shell with a success status. It now answers 404, which needs nginx to know which routes exist: most it infers from the build output, but dynamic routes and ones that never opted into prerendering have no file on disk and are listed by hand. Those hand-maintained lists drift, and the drift is invisible until it ships: vite dev and npm run preview route from the client manifest and never read nginx.conf, so a new dynamic route works everywhere a developer would look and 404s in production. hack/check-web-routes.sh compares the lists against web/src/routes, and a workflow runs it. Its own workflow rather than another job on license-compliance.yml, which already carries one unrelated check. Also turns absolute_redirect off. With nginx's default the trailing-slash canonicaliser reconstructs the origin from its own listen port, so a request for https://demo.cairnobs.org/settings/ was answered with Location: http://127.0.0.1:3000/settings -- the container's internal address, unreachable from the client, and downgraded to http on the way. Verified by curl against the built image; it was latent here before the canonicaliser existed too, through the directory redirect on /dev.
28 lines
1019 B
YAML
28 lines
1019 B
YAML
name: Web route check
|
|
|
|
# web/nginx.conf answers 404 for any path that isn't a route, which means
|
|
# it has to know which routes exist. Most it infers from the build output,
|
|
# but dynamic routes (dashboards/[id] and friends) and non-prerendered
|
|
# routes (/data-sources) have no file on disk and are hand-listed there.
|
|
#
|
|
# That list drifting is a production-only failure: `vite dev` and
|
|
# `npm run preview` route from the client manifest and never read
|
|
# nginx.conf, so a new dynamic route works perfectly everywhere a
|
|
# developer would look and 404s the moment it ships. This job is what
|
|
# catches it. Its own workflow rather than another job bolted onto
|
|
# license-compliance.yml, which already carries one unrelated check
|
|
# (tenant-boundary) for historical reasons worth not compounding.
|
|
|
|
on:
|
|
push:
|
|
branches: [master, main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
web-routes:
|
|
name: nginx route allowlist check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- run: bash hack/check-web-routes.sh
|