Equativ Bid Adapter: address upstream PR review comments

.ci-test

@@ -0,0 +1 @@
+# ci e2e test 2

.github/workflows/prebid-code-scanner.yml

@@ -0,0 +1,37 @@
+name: Prebid code scanner
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+  push:
+    branches:
+      - master
+      - '*-legacy'
+
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
+  security-events: write
+
+jobs:
+  scan:
+    name: "Prebid code scanner"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (PR)
+        if: ${{ github.event_name == 'pull_request_target' }}
+        uses: actions/checkout@v6
+        with:
+          ref: refs/pull/${{ github.event.pull_request.number }}/head
+          fetch-depth: 0
+      - name: Checkout (Push)
+        if: ${{ github.event_name == 'push' }}
+        uses: actions/checkout@v6
+      - name: Scan
+        uses: prebid/code-scanner@main
+        with:
+          token: ${{ github.token }}
+          pem: ${{ secrets.CODE_SCANNER_PEM }}
+          appId: ${{ vars.CODE_SCANNER_APPID }}
+          installationId: ${{ vars.CODE_SCANNER_INSTALLATION }}

.gitlab-ci.yml

@@ -0,0 +1,60 @@
+stages:
+  - ship-upstream
+  - sync-upstream
+
+# ── Push merged branch to sharethrough/Prebid.js ────────────────────────────
+#
+# Runs only when a commit lands on github-sharethrough-prebidjs (i.e. after an
+# MR is merged).  The job is skipped when the MR carries the "no-upstream"
+# label (checked inside the script via the GitLab MR API).
+#
+# Required CI/CD variables (Settings → CI/CD → Variables, masked + protected):
+#   GH_APP_ID          – GitHub App numeric ID
+#   GH_APP_PRIVATE_KEY – GitHub App private key (RSA PEM, newlines as \n or real)
+#
+
+ship-to-upstream:
+  stage: ship-upstream
+  image: alpine:3.20
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "github-sharethrough-prebidjs" && $CI_PIPELINE_SOURCE == "push"'
+  allow_failure: true
+  variables:
+    GIT_STRATEGY: fetch
+    GIT_DEPTH: 0       # full history required for push
+  before_script:
+    - apk add --no-cache bash git curl jq openssl
+  script:
+    - bash ci/ship-to-upstream.sh
+
+# ── Sync prebid/Prebid.js master into github-sharethrough-prebidjs ──────────
+#
+# Keeps the long-lived branch tracking upstream (the source of truth) so that
+# new MRs and the shipped GitHub PRs show small diffs.  Merges upstream into
+# the branch, preserving the branch-only files (ci/, .gitlab-ci.yml, equativ
+# adapter).  Fails without pushing on a merge conflict — resolve by hand.
+#
+# Trigger:
+#   • automatically on a scheduled pipeline (Settings → CI/CD → Schedules,
+#     target branch github-sharethrough-prebidjs)
+#   • manually via Pipelines → Run pipeline (web), then play the job
+#
+# Required CI/CD variable (masked):
+#   GITLAB_PUSH_TOKEN – project/group access token (or PAT) with
+#                       write_repository, allowed to push to the protected
+#                       github-sharethrough-prebidjs branch.
+
+sync-from-upstream:
+  stage: sync-upstream
+  image: alpine:3.20
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+    - if: '$CI_PIPELINE_SOURCE == "web"'
+      when: manual
+  variables:
+    GIT_STRATEGY: fetch
+    GIT_DEPTH: 0       # full history required to compute the merge
+  before_script:
+    - apk add --no-cache bash git
+  script:
+    - bash ci/sync-upstream.sh

ci/ship-to-upstream.sh

@@ -0,0 +1,194 @@
+#!/usr/bin/env bash
+# ship-to-upstream.sh
+#
+# Triggered on every push to github-sharethrough-prebidjs (i.e. after an MR is
+# merged).  Finds the MR that produced the merge commit, and — unless the MR
+# carries the "no-upstream" label — pushes the source branch to
+# sharethrough/Prebid.js.
+#
+# Required env vars (supplied by GitLab CI):
+#   CI_COMMIT_SHA        – merge commit SHA
+#   CI_PROJECT_ID        – numeric GitLab project ID
+#   CI_JOB_TOKEN         – short-lived token for same-project API reads
+#   GH_APP_ID            – GitHub App ID (masked CI variable)
+#   GH_APP_PRIVATE_KEY   – GitHub App private key PEM (masked CI variable)
+#
+# Optional env vars:
+#   GITLAB_API_URL       – defaults to https://gitlab.com/api/v4
+#   GITHUB_API_URL       – defaults to https://api.github.com
+#   FORK_REPO            – sharethrough fork, defaults to sharethrough/Prebid.js
+
+set -euo pipefail
+
+GITLAB_API_URL="${GITLAB_API_URL:-https://gitlab.com/api/v4}"
+GITHUB_API_URL="${GITHUB_API_URL:-https://api.github.com}"
+FORK_REPO="${FORK_REPO:-sharethrough/Prebid.js}"
+FORK_ORG="${FORK_REPO%%/*}"
+
+# ── 1. Find the MR that produced this merge commit ──────────────────────────
+
+echo "==> Looking up MR for commit ${CI_COMMIT_SHA}"
+
+MR_JSON=$(curl -sf \
+  --header "JOB-TOKEN: ${CI_JOB_TOKEN}" \
+  "${GITLAB_API_URL}/projects/${CI_PROJECT_ID}/merge_requests?state=merged&target_branch=github-sharethrough-prebidjs&order_by=updated_at&sort=desc&per_page=20" \
+  | jq -r --arg sha "${CI_COMMIT_SHA}" \
+      '[.[] | select(.merge_commit_sha == $sha)] | first')
+
+if [ -z "${MR_JSON}" ] || [ "${MR_JSON}" = "null" ]; then
+  echo "No merged MR found for commit ${CI_COMMIT_SHA} — skipping (direct push?)"
+  exit 0
+fi
+
+SOURCE_BRANCH=$(echo "${MR_JSON}" | jq -r '.source_branch')
+MR_IID=$(echo "${MR_JSON}"       | jq -r '.iid')
+MR_TITLE=$(echo "${MR_JSON}"     | jq -r '.title')
+LABELS=$(echo "${MR_JSON}"       | jq -r '[.labels[]] | join(",")')
+
+echo "    MR !${MR_IID}: ${MR_TITLE}"
+echo "    Source branch : ${SOURCE_BRANCH}"
+echo "    Labels        : ${LABELS:-<none>}"
+
+# ── 2. Bail out if the MR carries the no-upstream label ─────────────────────
+
+if echo ",${LABELS}," | grep -q ",no-upstream,"; then
+  echo "==> Label 'no-upstream' detected — skipping upstream ship"
+  exit 0
+fi
+
+# ── 3. Mint a GitHub App installation token ─────────────────────────────────
+
+echo "==> Minting GitHub App installation token"
+
+# Write the PEM key to a temp file; handle both real newlines and literal \n.
+TMPKEY=$(mktemp /tmp/gh-app-key.XXXXXX)
+trap 'rm -f "${TMPKEY}"' EXIT
+
+printf '%s' "${GH_APP_PRIVATE_KEY}" > "${TMPKEY}"
+# If the PEM header isn't on its own line the key was stored with literal \n —
+# replace them with real newlines.
+if ! grep -q '^-----' "${TMPKEY}"; then
+  printf '%s' "${GH_APP_PRIVATE_KEY}" | sed 's/\\n/\n/g' > "${TMPKEY}"
+fi
+chmod 600 "${TMPKEY}"
+
+# Build a RS256 JWT: base64url(header).base64url(payload)
+_b64url() { base64 -w 0 | tr '+/' '-_' | tr -d '='; }
+
+NOW=$(date +%s)
+HEADER=$(printf '{"alg":"RS256","typ":"JWT"}'                                       | _b64url)
+PAYLOAD=$(printf '{"iat":%d,"exp":%d,"iss":"%s"}' "$((NOW - 60))" "$((NOW + 540))" \
+            "${GH_APP_ID}"                                                           | _b64url)
+
+SIGNING_INPUT="${HEADER}.${PAYLOAD}"
+
+SIGNATURE=$(printf '%s' "${SIGNING_INPUT}" \
+  | openssl dgst -sha256 -sign "${TMPKEY}" -binary \
+  | _b64url)
+
+JWT="${SIGNING_INPUT}.${SIGNATURE}"
+
+# Resolve the installation that belongs to the fork org.
+INSTALLATION_ID=$(curl -sf \
+  -H "Authorization: Bearer ${JWT}" \
+  -H "Accept: application/vnd.github+json" \
+  "${GITHUB_API_URL}/app/installations" \
+  | jq -r --arg org "${FORK_ORG}" \
+      '.[] | select(.account.login == $org) | .id')
+
+if [ -z "${INSTALLATION_ID}" ]; then
+  echo "ERROR: No GitHub App installation found for org '${FORK_ORG}'" >&2
+  exit 1
+fi
+
+GH_TOKEN=$(curl -sf -X POST \
+  -H "Authorization: Bearer ${JWT}" \
+  -H "Accept: application/vnd.github+json" \
+  "${GITHUB_API_URL}/app/installations/${INSTALLATION_ID}/access_tokens" \
+  | jq -r '.token')
+
+echo "    Installation ID : ${INSTALLATION_ID}"
+echo "    Token obtained  : yes"
+
+# ── 4. Push only MR commits (no CI files) to sharethrough/Prebid.js ─────────
+#
+# Feature branches are based on github-sharethrough-prebidjs which carries
+# .gitlab-ci.yml and ci/ — files that must not go to the public GitHub fork.
+# Strategy: identify the two parents of the merge commit, cherry-pick the
+# MR-specific commits (PARENT1..PARENT2) onto sharethrough/Prebid.js master
+# (the fork's own master, not prebid upstream — avoids showing commits the
+# fork hasn't synced yet), then push that instead of the full branch.
+
+echo "==> Pushing ${SOURCE_BRANCH} to ${FORK_REPO} (CI files excluded)"
+
+# Identify the two parents of the merge commit.
+PARENTS=$(git log --pretty=format:"%P" -1 "${CI_COMMIT_SHA}")
+PARENT1=$(echo "${PARENTS}" | awk '{print $1}')   # previous tip of target branch
+PARENT2=$(echo "${PARENTS}" | awk '{print $2}')   # tip of source branch (MR head)
+
+git remote add github-fork \
+  "https://x-access-token:${GH_TOKEN}@github.com/${FORK_REPO}.git" 2>/dev/null \
+  || git remote set-url github-fork \
+       "https://x-access-token:${GH_TOKEN}@github.com/${FORK_REPO}.git"
+
+if [ -z "${PARENT2}" ]; then
+  echo "    Not a merge commit — pushing full branch as-is"
+  git push github-fork "HEAD:refs/heads/${SOURCE_BRANCH}" --force
+else
+  # Fetch the fork's own master as the base — PR diff will then show only our
+  # cherry-picked commits, regardless of how far behind the fork is from upstream.
+  git fetch github-fork master --depth=1
+
+  # Cherry-pick requires a git identity in the CI environment.
+  git config --global user.email "ci-bot@sharethrough.com"
+  git config --global user.name "Sharethrough CI"
+
+  # Cherry-pick MR commits onto the fork's master — no CI files in the result.
+  TEMP_BRANCH="ship-$$"
+  git checkout -b "${TEMP_BRANCH}" github-fork/master
+
+  if git cherry-pick "${PARENT1}..${PARENT2}" --allow-empty; then
+    echo "    Cherry-pick succeeded — pushing without CI files"
+    git push github-fork "${TEMP_BRANCH}:refs/heads/${SOURCE_BRANCH}" --force
+  else
+    echo "    Cherry-pick had conflicts — falling back to full push"
+    git cherry-pick --abort 2>/dev/null || true
+    git checkout -
+    git push github-fork "HEAD:refs/heads/${SOURCE_BRANCH}" --force
+  fi
+
+  git checkout - 2>/dev/null || true
+  git branch -D "${TEMP_BRANCH}" 2>/dev/null || true
+fi
+
+echo "    Branch pushed to ${FORK_REPO}/${SOURCE_BRANCH}"
+
+# ── 5. Open a PR on sharethrough/Prebid.js ──────────────────────────────────
+
+echo "==> Opening PR on ${FORK_REPO}"
+
+DEFAULT_BRANCH=$(curl -sf \
+  -H "Authorization: Bearer ${GH_TOKEN}" \
+  -H "Accept: application/vnd.github+json" \
+  "${GITHUB_API_URL}/repos/${FORK_REPO}" \
+  | jq -r '.default_branch')
+
+PR_URL=$(curl -sf -X POST \
+  -H "Authorization: Bearer ${GH_TOKEN}" \
+  -H "Accept: application/vnd.github+json" \
+  "${GITHUB_API_URL}/repos/${FORK_REPO}/pulls" \
+  --data "$(jq -n \
+    --arg title "${MR_TITLE}" \
+    --arg head  "${SOURCE_BRANCH}" \
+    --arg base  "${DEFAULT_BRANCH}" \
+    --arg body  "GitLab MR !${MR_IID}: ${MR_TITLE}" \
+    '{title: $title, head: $head, base: $base, body: $body}')" \
+  | jq -r '.html_url')
+
+if [ -z "${PR_URL}" ] || [ "${PR_URL}" = "null" ]; then
+  echo "    WARNING: PR may already exist or could not be created"
+else
+  echo "    PR opened: ${PR_URL}"
+fi
+
+echo "==> Done"

ci/sync-upstream.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# sync-upstream.sh
+#
+# Merges prebid/Prebid.js master into github-sharethrough-prebidjs so the
+# long-lived branch keeps tracking upstream.  Upstream is the source of truth;
+# the branch's own commits (CI files under ci/, .gitlab-ci.yml, the equativ
+# adapter customisations) are preserved by the merge — a merge only ADDS the
+# upstream changes, it never drops files that exist only on this branch.
+#
+# Runs on a schedule and can also be triggered manually from the GitLab UI
+# (Pipelines → Run pipeline, then play the job).  See .gitlab-ci.yml.
+#
+# On a merge conflict the job aborts WITHOUT pushing and exits non-zero, so a
+# human resolves it locally.  The push uses `-o ci.skip` so the resulting merge
+# commit does NOT trigger the ship-to-upstream pipeline (there is no MR behind
+# a sync merge, so ship would only skip anyway — this just avoids the noise).
+#
+# Required env vars (GitLab CI):
+#   GITLAB_PUSH_TOKEN  – token with write_repository on this project, allowed
+#                        to push to the protected branch (project/group access
+#                        token with Maintainer role, or a PAT).  Masked.
+#   CI_SERVER_HOST     – provided by GitLab
+#   CI_PROJECT_PATH    – provided by GitLab
+#
+# Optional env vars:
+#   UPSTREAM_REPO_URL  – defaults to https://github.com/prebid/Prebid.js.git
+#   UPSTREAM_BRANCH    – defaults to master
+#   TARGET_BRANCH      – defaults to github-sharethrough-prebidjs
+
+set -euo pipefail
+
+UPSTREAM_REPO_URL="${UPSTREAM_REPO_URL:-https://github.com/prebid/Prebid.js.git}"
+UPSTREAM_BRANCH="${UPSTREAM_BRANCH:-master}"
+TARGET_BRANCH="${TARGET_BRANCH:-github-sharethrough-prebidjs}"
+
+: "${GITLAB_PUSH_TOKEN:?GITLAB_PUSH_TOKEN must be set (write_repository token allowed to push to ${TARGET_BRANCH})}"
+
+echo "==> Syncing ${UPSTREAM_REPO_URL}@${UPSTREAM_BRANCH} into ${TARGET_BRANCH}"
+
+# ── Identity (required to create a merge commit) ────────────────────────────
+git config --global user.email "ci-bot@sharethrough.com"
+git config --global user.name  "Sharethrough CI"
+
+# ── Remotes ─────────────────────────────────────────────────────────────────
+git remote add upstream "${UPSTREAM_REPO_URL}" 2>/dev/null \
+  || git remote set-url upstream "${UPSTREAM_REPO_URL}"
+
+# `origin` in CI authenticates with CI_JOB_TOKEN, which cannot push to a
+# protected branch — use a dedicated remote carrying the push token.
+PUSH_URL="https://oauth2:${GITLAB_PUSH_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"
+git remote add gitlab-push "${PUSH_URL}" 2>/dev/null \
+  || git remote set-url gitlab-push "${PUSH_URL}"
+
+# ── Fetch both sides ────────────────────────────────────────────────────────
+echo "==> Fetching upstream and target"
+git fetch upstream "${UPSTREAM_BRANCH}"
+git fetch origin   "${TARGET_BRANCH}"
+
+# Start from origin's tip of the target branch (the CI checkout may be detached).
+git checkout -B "${TARGET_BRANCH}" "origin/${TARGET_BRANCH}"
+
+# ── Already up to date? ─────────────────────────────────────────────────────
+BEHIND=$(git rev-list --count "HEAD..upstream/${UPSTREAM_BRANCH}")
+echo "    ${BEHIND} upstream commit(s) to merge"
+if [ "${BEHIND}" -eq 0 ]; then
+  echo "==> Already up to date — nothing to do"
+  exit 0
+fi
+
+# ── Merge (preserves branch-only files; fails on conflict) ──────────────────
+echo "==> Merging upstream/${UPSTREAM_BRANCH}"
+if git merge --no-ff -m "ci: sync upstream/${UPSTREAM_BRANCH} into ${TARGET_BRANCH}" \
+     "upstream/${UPSTREAM_BRANCH}"; then
+  echo "    Merge clean"
+else
+  echo "ERROR: merge conflict — aborting without pushing. Resolve manually:" >&2
+  git --no-pager diff --name-only --diff-filter=U >&2 || true
+  git merge --abort 2>/dev/null || true
+  exit 1
+fi
+
+# ── Push (skip CI so this merge doesn't trigger ship-to-upstream) ───────────
+echo "==> Pushing ${TARGET_BRANCH}"
+git push -o ci.skip gitlab-push "HEAD:refs/heads/${TARGET_BRANCH}"
+
+echo "==> Done — ${TARGET_BRANCH} now tracks upstream/${UPSTREAM_BRANCH}"

libraries/intentIqConstants/intentIqConstants.js

@@ -5,11 +5,10 @@ export const SUPPORTED_TYPES = ["html5", "cookie"];
 export const WITH_IIQ = "A";
 export const WITHOUT_IIQ = "B";
 export const DEFAULT_PERCENTAGE = 95;
-export const BLACK_LIST = "L";
 export const CLIENT_HINTS_KEY = "_iiq_ch";
 export const EMPTY = "EMPTY";
 export const GVLID = "1323";
-export const VERSION = 0.36;
+export const VERSION = 0.37;
 export const PREBID = "pbjs";
 export const HOURS_24 = 86400000;
 export const HOURS_72 = HOURS_24 * 3;