fix: harden next.config rewrites against wrapper overwrites

.gitea/workflows/deploy.yml

@@ -154,13 +154,27 @@ jobs:
         run: |
           echo "${{ secrets.REGISTRY_PASS }}" | docker login registry.infra.mintel.me -u "${{ secrets.REGISTRY_USER }}" --password-stdin
 
-      - name: Clean runner
+      - name: 🧹 Nuclear Runner Cleanup
         run: |
-          echo "Disk space before prune:"
+          echo "Disk space before nuclear prune:"
           df -h
+          
+          # Massive cleanup of pre-installed runner software to free up ~5GB+
+          # These are standard on VM-based runners and often unnecessary
+          sudo rm -rf /usr/share/dotnet || true
+          sudo rm -rf /usr/local/lib/android || true
+          sudo rm -rf /opt/ghc || true
+          sudo rm -rf /opt/hostedtoolcache/CodeQL || true
+          
+          # Comprehensive Docker purge
           docker system prune -af --volumes
           docker builder prune -af
-          echo "Disk space after prune:"
+          docker buildx prune -af
+          
+          # Clean temp build artifacts
+          rm -rf /tmp/docker-actions-toolkit-* || true
+          
+          echo "Disk space after nuclear prune:"
           df -h
         continue-on-error: true
 
@@ -186,8 +200,9 @@ jobs:
             PAYLOAD_SECRET=${{ secrets.PAYLOAD_SECRET || 'secret' }}
             BUILD_ID=${{ github.sha }}
           tags: registry.infra.mintel.me/mintel/mintel.me:${{ needs.prepare.outputs.image_tag }}
+          # Temporarily disable registry cache export to save runner disk/bandwidth
           cache-from: type=registry,ref=registry.infra.mintel.me/mintel/mintel.me:buildcache-${{ needs.prepare.outputs.target }}
-          cache-to: type=registry,ref=registry.infra.mintel.me/mintel/mintel.me:buildcache-${{ needs.prepare.outputs.target }},mode=max
+          # cache-to: type=registry,ref=registry.infra.mintel.me/mintel/mintel.me:buildcache-${{ needs.prepare.outputs.target }},mode=max
           secrets: |
             NPM_TOKEN=${{ secrets.NPM_TOKEN }}
 
@@ -442,6 +457,7 @@ jobs:
       - name: 🌐 Check Production URL
         shell: sh
         run: |
+          apk add --no-cache curl
           # Wait longer (up to 2 minutes) for Next.js to fully prime
           COUNT=0
           MAX=24
@@ -464,17 +480,44 @@ jobs:
             exit 1
           fi
 
-      - name: 🌐 Check Case Study Assets
+      - name: 🌐 Check Case Study Assets and Rewrites
         shell: sh
         run: |
-          URL="${{ needs.prepare.outputs.next_public_url }}/case-studies/klz-cables"
-          echo "Verifying case study $URL..."
-          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$URL")
+          BASE_URL="${{ needs.prepare.outputs.next_public_url }}"
+          
+          echo "Verifying diagnostic rewrite..."
+          STATUS=$(curl -s -L -o /dev/null -w "%{http_code}" "$BASE_URL/robots-test")
+          if [ "$STATUS" != "200" ]; then
+            echo "❌ Diagnostic rewrite /robots-test failed! (Status: $STATUS)"
+            exit 1
+          fi
+          echo "✅ Diagnostic rewrite OK"
+          
+          echo "Verifying case study page..."
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE_URL/case-studies/klz-cables")
           if [ "$STATUS" != "200" ]; then
             echo "❌ Case study page failed! (Status: $STATUS)"
             exit 1
           fi
-          echo "✅ Case study page is UP"
+          echo "✅ Case study page UP"
+          
+          echo "Verifying breeze CSS (root path)..."
+          CSS_PATH="/assets/klz-cables.com/wp-content/cache/breeze-minification/css/breeze_klz-cables-com-1-10895.css"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE_URL$CSS_PATH")
+          if [ "$STATUS" != "200" ]; then
+            echo "❌ Root asset path failed! (Status: $STATUS)"
+            exit 1
+          fi
+          echo "✅ Root asset path OK"
+          
+          echo "Verifying breeze CSS (relative path from case-study)..."
+          REL_CSS_PATH="/case-studies/assets/klz-cables.com/wp-content/cache/breeze-minification/css/breeze_klz-cables-com-1-10895.css"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE_URL$REL_CSS_PATH")
+          if [ "$STATUS" != "200" ]; then
+            echo "❌ Relative asset path failed! (Status: $STATUS)"
+            exit 1
+          fi
+          echo "✅ Relative asset path OK"
 
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 6: Notifications

Dockerfile

@@ -39,6 +39,9 @@ ENV CI=true
 # Copy manifest files specifically for better layer caching
 COPY pnpm-lock.yaml pnpm-workspace.yaml package.json .npmrc* ./
 COPY apps/web/package.json ./apps/web/package.json
+# Install build dependencies for native modules (like canvas)
+RUN apk add --no-cache python3 make g++ pkgconfig pixman-dev cairo-dev pango-dev libjpeg-turbo-dev giflib-dev librsvg-dev
+
 # Copy sibling monorepo for linked dependencies (cloned during CI)
 # Placing it inside /app so relative links like ../../_at-mintel resolve correctly!
 COPY _at-mintel* /app/_at-mintel/

apps/web/next.config.mjs

@@ -14,7 +14,7 @@ const nextConfig = {
     'sharp',
     'puppeteer',
     'require-in-the-middle',
-    'import-in-the-middle' // Sentry 10+ instrumentation dependencies
+    'import-in-the-middle'
   ],
   transpilePackages: [
     '@mintel/content-engine',
@@ -37,24 +37,6 @@ const nextConfig = {
       },
     ],
   },
-  async rewrites() {
-    return [
-      // Umami proxy rewrite handled in app/stats/api/send/route.ts
-      // Sentry relay handled in app/errors/api/relay/route.ts
-      {
-        source: '/assets/:path*',
-        destination: '/showcase/klz-cables.com/assets/:path*',
-      },
-      {
-        source: '/wp-content/:path*',
-        destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-content/:path*',
-      },
-      {
-        source: '/wp-includes/:path*',
-        destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-includes/:path*',
-      },
-    ];
-  },
   async redirects() {
     return [
       {
@@ -67,7 +49,58 @@ const nextConfig = {
   outputFileTracingRoot: path.join(dirname, '../../'),
 };
 
-const withMDX = createMDX({
-  // Add markdown plugins here, as desired
-});
-export default withPayload(withMintelConfig(withMDX(nextConfig)));
+const withMDX = createMDX({});
+
+// Apply wrappers
+const wrappedConfig = withPayload(withMintelConfig(withMDX(nextConfig)));
+
+// HARDEN REWRITES: Manually merge showcase rules to prevent wrapper overwrites
+const originalRewrites = wrappedConfig.rewrites;
+wrappedConfig.rewrites = async () => {
+  const existing = await originalRewrites?.() || [];
+  
+  // Normalize existing to object pattern (Next.js supports both Array and Object)
+  const normalized = Array.isArray(existing) 
+    ? { afterFiles: existing, beforeFiles: [], fallback: [] } 
+    : existing;
+
+  return {
+    ...normalized,
+    beforeFiles: [
+      ...(normalized.beforeFiles || []),
+      // Diagnostic rule
+      {
+        source: '/robots-test',
+        destination: '/robots.txt',
+      },
+      // Assets requested from root
+      {
+        source: '/assets/:path*',
+        destination: '/showcase/klz-cables.com/assets/:path*',
+      },
+      {
+        source: '/wp-content/:path*',
+        destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-content/:path*',
+      },
+      {
+        source: '/wp-includes/:path*',
+        destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-includes/:path*',
+      },
+      // Assets requested relatively from case-studies/work/blog subpages
+      {
+        source: '/:folder(case-studies|work|blog)/assets/:path*',
+        destination: '/showcase/klz-cables.com/assets/:path*',
+      },
+      {
+        source: '/:folder(case-studies|work|blog)/wp-content/:path*',
+        destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-content/:path*',
+      },
+      {
+        source: '/:folder(case-studies|work|blog)/wp-includes/:path*',
+        destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-includes/:path*',
+      },
+    ],
+  };
+};
+
+export default wrappedConfig;