Deploy and sync: say why /security/report has no Turnstile (#164)

The first deploy with the Turnstile permission no longer warned that it couldn't create the widget,
but /security/report still showed no Turnstile, and the reason was only in Diffinery's deploy log.
The deploy check now says whether the Worker lacks a key or the page answered something else (with
its status), and the sync repeats the deploy's Turnstile lines (widget, site key, TURNSTILE_SECRET
set or not; the secret key itself is never printed).


Claude-Session: https://claude.ai/code/session_016yhgAu6oKfqes812Yd4qjo

Co-authored-by: Claude <noreply@anthropic.com>

Canberk Demirci authored 12 days ago· GitHub committed 12 days agosigned1 parent a7e3f13commit 5e425b5583d9d0698e501e7bf99ae453cc0b9ab4Browse files

2 files changed+10−3

modified.github/workflows/deploy.yml+6−2View file

modifiedscripts/diffinery-wait-runs.sh+4−1View file

		@@ -100,10 +100,14 @@
100	100	loc=$(curl -sS -o /dev/null -w '%{http_code} %{redirect_url}' https://$DIFFINERY_DOMAIN/auth/access)
101	101	echo "/auth/access -> $loc"
102	102	[[ "$loc" == 302\ https://.cloudflareaccess.com/ ]] \|\| echo "::warning::/auth/access is not behind Cloudflare Access yet, so email recovery and first admin sign-in will not work"
103		- if grep -q 'class="cf-turnstile"' <<<"$(curl -sS https://$DIFFINERY_DOMAIN/security/report)"; then
	103	+ report=$(curl -sS -w '\n%{http_code}' https://$DIFFINERY_DOMAIN/security/report)
	104	+ code=${report##*$'\n'}
	105	+ if grep -q 'class="cf-turnstile"' <<<"$report"; then
104	106	echo "/security/report shows Turnstile to people who aren't signed in"
	107	+ elif grep -q 'has no Turnstile configured' <<<"$report"; then
	108	+ echo "::warning::/security/report has no Turnstile, so only people who are signed in can send security reports: the Worker lacks TURNSTILE_SITE_KEY or TURNSTILE_SECRET (see the bootstrap and Worker secrets steps)"
105	109	else
106		- echo "::warning::/security/report has no Turnstile, so only people who are signed in can send security reports"
	110	+ echo "::warning::/security/report has no Turnstile, so only people who are signed in can send security reports: it answered $code without the form"
107	111	fi
108	112	for kind in js css; do
109	113	asset=$(grep -o "/-/kumo/[a-z0-9]*\.$kind" <<<"$page" \| head -1)

		@@ -56,9 +56,12 @@
56	56	# bootstrap needs, say): repeat them here, where they can be read without access to Diffinery.
57	57	if [ "$(jq -r .name <<<"$run")" = Deploy ]; then
58	58	for job in $(jq -r '.jobs[] \| select(.conclusion != "skipped") \| .id' <<<"$jobs"); do
59		- api "/actions/jobs/$job/logs" 2>/dev/null \| sed -nE 's/^.(##\[warning\]\|::warning[^:]::)//p' \| head -n 40 \| while IFS= read -r w; do
	59	+ log=$(api "/actions/jobs/$job/logs" 2>/dev/null) \|\| true
	60	+ sed -nE 's/^.(##\[warning\]\|::warning[^:]::)//p' <<<"$log" \| head -n 40 \| while IFS= read -r w; do
60	61	echo "::warning::Diffinery Deploy: $w"
61	62	done \|\| true
	63	+ # What the deploy did about Turnstile (site keys are public; the secret key is never printed).
	64	+ grep -E 'Turnstile widget\|TURNSTILE_SECRET\|site key:\|/security/report' <<<"$log" \| grep -v 'warning' \| head -n 10 \| sed 's/^/ deploy: /' \|\| true
62	65	done
63	66	fi
64	67	# A skipped run (every job's `if` was false) is fine; a skipped Deploy after a failed CI

codician/diffinerypublic

Deploy and sync: say why /security/report has no Turnstile (#164)