fix(ci): align PAYLOAD_SECRET for post-deploy cleanup and enhance diagnostics

.gitea/workflows/deploy.yml

@@ -532,7 +532,7 @@ jobs:
         env:
           NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
           GATEKEEPER_PASSWORD: ${{ secrets.GATEKEEPER_PASSWORD || 'klz2026' }}
-          PAYLOAD_SECRET: ${{ secrets.PAYLOAD_SECRET || vars.PAYLOAD_SECRET }}
+          PAYLOAD_SECRET: ${{ secrets.PAYLOAD_SECRET || vars.PAYLOAD_SECRET || 'you-need-to-set-a-payload-secret' }}
           PUPPETEER_EXECUTABLE_PATH: /usr/bin/chromium
         run: pnpm run check:forms
 

package.json

@@ -139,7 +139,7 @@
     "prepare": "husky",
     "preinstall": "npx only-allow pnpm"
   },
-  "version": "2.3.22-rc.2",
+  "version": "2.3.22-rc.3",
   "pnpm": {
     "onlyBuiltDependencies": [
       "@parcel/watcher",

scripts/check-forms.ts

@@ -115,7 +115,9 @@ async function main() {
     // Intercept Next.js chunks and data to bypass Varnish 404-caching
     // Includes standard /_next/ and subpath /gatekeeper/_next/
     if (
-      (url.includes('/_next/static/') || url.includes('/_next/data/') || url.includes('/gatekeeper/_next/')) && 
+      (url.includes('/_next/static/') ||
+        url.includes('/_next/data/') ||
+        url.includes('/gatekeeper/_next/')) &&
       !url.includes('?cb=') &&
       !url.includes('&cb=')
     ) {
@@ -167,7 +169,9 @@ async function main() {
     if (chunkErrorsDetected) {
       const buster = `cb=${Date.now()}`;
       const cbUrl = finalUrl.includes('?') ? `${finalUrl}&${buster}` : `${finalUrl}?${buster}`;
-      console.warn(`   ⚠️ Assets failed to load (Varnish staleness suspected). Retrying with cache-buster: ${cbUrl}`);
+      console.warn(
+        `   ⚠️ Assets failed to load (Varnish staleness suspected). Retrying with cache-buster: ${cbUrl}`,
+      );
       chunkErrorsDetected = false;
       await page.goto(cbUrl, { waitUntil: 'networkidle2', timeout: 30000 });
     }
@@ -351,7 +355,13 @@ async function main() {
   const payloadSecret = process.env.PAYLOAD_SECRET;
 
   if (!payloadSecret) {
-    console.warn(`   ⚠️ PAYLOAD_SECRET not found in environment. Cleanup will likely fail with 403.`);
+    console.warn(
+      `   ⚠️ PAYLOAD_SECRET not found in environment. Cleanup will likely fail with 403 if the server expects a secret.`,
+    );
+  } else {
+    console.log(
+      `   🔐 PAYLOAD_SECRET found (${payloadSecret.substring(0, 3)}...). Sending x-e2e-secret header.`,
+    );
   }
 
   try {
@@ -380,9 +390,7 @@ async function main() {
         });
         console.log(`   ✅ Deleted submission: ${doc.id} (${doc.name})`);
       } catch (delErr: any) {
-        console.warn(
+        console.warn(`   ⚠️ Cleanup attempt on ${doc.id} failed: ${delErr.message}`);
-          `   ⚠️ Cleanup attempt on ${doc.id} failed: ${delErr.message}`,
-        );
       }
     }
 
@@ -391,11 +399,15 @@ async function main() {
     }
   } catch (err: any) {
     if (err.response?.status === 403) {
-      console.error(
+      console.error(`   ❌ Cleanup failed with 403 Forbidden.`);
-        `   ❌ Cleanup failed with 403 Forbidden. Ensure FormSubmissions access control and PAYLOAD_SECRET are aligned.`,
+      console.error(`      Detail: The server rejected the x-e2e-secret header.`);
-      );
+      console.error(`      Server Response: ${JSON.stringify(err.response.data)}`);
     } else {
       console.error(`   ❌ Cleanup fetch failed: ${err.message}`);
+      if (err.response) {
+        console.error(`      Status: ${err.response.status}`);
+        console.error(`      Body: ${JSON.stringify(err.response.data)}`);
+      }
     }
   }