ci: check each release page for a Cloudflare challenge instead of version.txt

.github/workflows/release.yml

@@ -79,26 +79,24 @@ jobs:
       EXPECTED_SHA: ${{ github.event.pull_request.merge_commit_sha }}
     steps:
       # Bot Fight Mode on codercops.com answers GitHub's runners with a
-      # Cloudflare challenge (403 with cf-mitigated: challenge) instead of the
-      # site, and production has no workers.dev address to check instead. Then
-      # the checks below can't see the deploy, so they're skipped with a notice
-      # and the live site gets checked by hand.
-      - name: Check whether Cloudflare challenges this runner
-        run: |
-          read -r STATUS MITIGATED < <(curl -s -o /dev/null -w "%{http_code} %header{cf-mitigated}\n" --max-time 15 "$BASE_URL/version.txt")
-          if [ "$STATUS" = "403" ] && [ "$MITIGATED" = "challenge" ]; then
-            echo "::notice::Cloudflare challenged this runner on $BASE_URL, so the deploy wasn't checked from here. Check the live site by hand."
-            echo "CHALLENGED=1" >> "$GITHUB_ENV"
-          fi
-
+      # Cloudflare challenge (403 with cf-mitigated: challenge) on HTML pages,
+      # but not on static files like version.txt. So the deploy is checked
+      # through version.txt, and a page that gets a challenge is reported with
+      # a notice instead of failing the release (CI already requested every
+      # page from the built Worker). Any other status still fails.
       - name: Wait for the Cloudflare deploy of this merge
-        if: env.CHALLENGED != '1'
         run: |
           # Workers Builds deploys production on its own. version.txt carries
           # the commit it built, so poll until it matches (up to 15 minutes).
+          LIVE=""
           for i in $(seq 1 90); do
-            LIVE=$(curl -s --max-time 10 "$BASE_URL/version.txt" | tr -d '[:space:]')
-            if [ "$LIVE" = "$EXPECTED_SHA" ]; then
+            read -r STATUS MITIGATED < <(curl -s -o version.out -w "%{http_code} %header{cf-mitigated}\n" --max-time 10 "$BASE_URL/version.txt")
+            if [ "$STATUS" = "403" ] && [ "$MITIGATED" = "challenge" ]; then
+              echo "::notice::Cloudflare challenged this runner on $BASE_URL/version.txt, so the deploy wasn't checked from here. Check the live site by hand."
+              exit 0
+            fi
+            LIVE=$(tr -d '[:space:]' < version.out 2>/dev/null || true)
+            if [ "$STATUS" = "200" ] && [ "$LIVE" = "$EXPECTED_SHA" ]; then
               echo "Live on $LIVE"
               exit 0
             fi
@@ -107,35 +105,26 @@ jobs:
           echo "::error::$BASE_URL serves ${LIVE:-nothing}, expected $EXPECTED_SHA"
           exit 1
 
-      - name: Homepage reachable
-        if: env.CHALLENGED != '1'
+      - name: Pages reachable
         run: |
-          STATUS=$(curl -sL -o /dev/null -w "%{http_code}" --max-time 15 "$BASE_URL/")
-          if [ "$STATUS" != "200" ]; then
-            echo "::error::Homepage returned status $STATUS"
-            exit 1
-          fi
-          echo "Homepage check passed"
-
-      - name: Tool page reachable
-        if: env.CHALLENGED != '1'
-        run: |
-          STATUS=$(curl -sL -o /dev/null -w "%{http_code}" --max-time 15 "$BASE_URL/json-formatter")
-          if [ "$STATUS" != "200" ]; then
-            echo "::error::/json-formatter returned status $STATUS"
-            exit 1
-          fi
-          echo "Tool page check passed"
-
-      - name: Sitemap valid
-        if: env.CHALLENGED != '1'
-        run: |
-          STATUS=$(curl -sL -o /dev/null -w "%{http_code}" --max-time 15 "$BASE_URL/sitemap.xml")
-          if [ "$STATUS" != "200" ]; then
-            echo "::error::sitemap.xml returned status $STATUS"
-            exit 1
+          fail=0
+          challenged=""
+          for path in / /json-formatter /sitemap.xml; do
+            read -r STATUS MITIGATED < <(curl -sL -o /dev/null -w "%{http_code} %header{cf-mitigated}\n" --max-time 15 "$BASE_URL$path")
+            if [ "$STATUS" = "200" ]; then
+              echo "200 $path"
+            elif [ "$STATUS" = "403" ] && [ "$MITIGATED" = "challenge" ]; then
+              echo "challenged $path"
+              challenged="$challenged $path"
+            else
+              echo "::error::$path returned status $STATUS"
+              fail=1
+            fi
+          done
+          if [ -n "$challenged" ]; then
+            echo "::notice::Cloudflare challenged this runner on$challenged, so those pages weren't checked from here. Check them by hand."
           fi
-          echo "Sitemap check passed"
+          exit "$fail"
 
   sync-develop:
     needs: [release, smoke-test]