ci: probe Artifactory reachability from CI (do not merge) - #2938
Draft
calvarezg wants to merge 5 commits into
Draft
ci: probe Artifactory reachability from CI (do not merge)#2938calvarezg wants to merge 5 commits into
calvarezg wants to merge 5 commits into
Conversation
Adds a throwaway CI job to test whether a GitHub-hosted runner can reach the Adobe Artifactory npm remote proxy (npm-quazar-gar-tf-remote, which fronts Semrush's Google Artifact Registry) and install @semrush/ai-seo-ts without auth, off the corp network. Result decides how we un-vendor @quazar/ai-seo-ts. Remove before finalizing the migration PR. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Corp-network cert chains to public DigiCert (trusted everywhere), yet the runner fails with unable-to-get-local-issuer. Add read-only DNS + openssl s_client inspection to capture the chain/issuers the runner actually receives. No TLS disabling. Still do-not-merge. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
This PR will trigger no release when merged. |
Runner hits an Adobe Banyan (ZTNA) gateway whose cert chains to the private Adobe Enterprise Root CA. Embed that public root, set NODE_EXTRA_CA_CERTS, and observe the HTTP code: 200 means CA trust was the only barrier; 401/403 means the Zero Trust gateway also enforces identity and public runners cannot pull. Still do-not-merge. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… runner Corp host is ZTNA-gated (settled). Repoint the probe at the machine host artifactory-uw2.adobeitc.com (public cert, token auth, used by mystique CI) to learn whether a public GitHub runner can reach it. Expect 401 (reachable, token needed); timeout/000 means internal-only. No auth, no secret. Drops the prior embedded-CA corp-host steps. Still do-not-merge. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Configures .npmrc to install the Semrush SDK from artifactory-uw2.adobeitc.com (machine host, reachable from CI) instead of the ZTNA-gated corp host. Token wired via ${ARTIFACTORY_AUTH_TOKEN}. Inert until the dependency is switched off file:third-party in Stage 2, so current install/CI is unaffected (@quazar still resolves from third-party/). Remaining: provision an Artifactory token with read scope on npm-quazar-gar-tf-remote as a CI secret.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Throwaway probe to answer one question: can a GitHub-hosted CI runner (public internet, off the Adobe corp network) reach the Adobe Artifactory npm proxy and install the Semrush SDK without auth?
This decides how we un-vendor
@quazar/ai-seo-ts(currently afile:third-party/ai-seo-tscopy) to install@semrush/ai-seo-tsfrom Artifactory instead.What it does
Adds one temporary CI job,
sr-artifactory-probe(PR-only, no secret):curl -Ithe registrynpm-quazar-gar-tf-remote(reachability + TLS).npm install @semrush/ai-seo-ts@0.102.1-gen2.7.0into a temp dir with a scoped.npmrc, no auth token.Reading the result
Context (verified locally)
npm-quazar-gar-tf-remote(rc-less). The-rc-variant 404s for everyone.us-npm.pkg.dev/quazar-gar-tf/npm-us).0.101.15is already gone). A pinned version can vanish and break clean installs — a retention question for Semrush before we depend on a pinned version.Do not merge. The probe job is removed before the real migration PR.
🤖 Generated with Claude Code