yuris/titik-gambut-next
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

fix(tiles): automated R2 bucket CORS deployment workflow and S3 method compliance #123

Merged
yuris merged 1 commit from fix/r2-cors-automation into main 2026-10-16 00:33:42 +00:00
Conversation 2 Commits 1 Files changed 4 +184 -35
yuris commented 2026-10-16 00:29:36 +00:00
Owner
Copy link

Executed playbook: skill://poteto-mode/playbooks/bug-fix.md

Principles applied

  • principle-model-the-domain: Modeled Cloudflare R2 bucket CORS specifications according to S3 API standards, strictly using GET and HEAD in AllowedMethods without unsupported OPTIONS.
  • principle-boundary-discipline: Isolated R2 storage policies and credentials to infrastructure scripts and CI secrets without modifying application runtime code.
  • principle-subtract-before-you-add: Avoided bespoke tools and used standard AWS S3 SDK commands (PutBucketCorsCommand, GetBucketCorsCommand) to manage R2 policies.
  • ponytail-review: Evaluated lean operational script additions and zero bloat in deployment workflows.

Impact

  • For the consumer: Vector basemap (indonesia.pmtiles) byte-range requests succeed without browser CORS blocking errors on production domains.
  • For the maintainer: Automated CORS rule enforcement runs deterministically in CI with repository secrets rather than manual dashboard configuration.

Summary

Automates Cloudflare R2 bucket CORS configuration via a dedicated Forgejo Actions workflow and fixes S3 API method compliance by removing unsupported OPTIONS from AllowedMethods.

Verification

  • vp check: Clean formatting and 0 lint warnings across 295 files.
  • pnpm test: All 271 unit tests passing across 36 test suites (including set-r2-cors.test.ts).
  • next build: Standalone Next.js production build succeeded cleanly.

Closes #38

Executed playbook: `skill://poteto-mode/playbooks/bug-fix.md` ### Principles applied - principle-model-the-domain: Modeled Cloudflare R2 bucket CORS specifications according to S3 API standards, strictly using GET and HEAD in AllowedMethods without unsupported OPTIONS. - principle-boundary-discipline: Isolated R2 storage policies and credentials to infrastructure scripts and CI secrets without modifying application runtime code. - principle-subtract-before-you-add: Avoided bespoke tools and used standard AWS S3 SDK commands (PutBucketCorsCommand, GetBucketCorsCommand) to manage R2 policies. - ponytail-review: Evaluated lean operational script additions and zero bloat in deployment workflows. ### Impact - **For the consumer:** Vector basemap (`indonesia.pmtiles`) byte-range requests succeed without browser CORS blocking errors on production domains. - **For the maintainer:** Automated CORS rule enforcement runs deterministically in CI with repository secrets rather than manual dashboard configuration. ### Summary Automates Cloudflare R2 bucket CORS configuration via a dedicated Forgejo Actions workflow and fixes S3 API method compliance by removing unsupported OPTIONS from AllowedMethods. ### Verification - `vp check`: Clean formatting and 0 lint warnings across 295 files. - `pnpm test`: All 271 unit tests passing across 36 test suites (including `set-r2-cors.test.ts`). - `next build`: Standalone Next.js production build succeeded cleanly. Closes #38
fix(tiles): automated R2 bucket CORS deployment workflow and S3 method compliance
All checks were successful
CI / Verify Quality & Build (pull_request) Successful in 1m56s
Details
edf18ff0a3
yuris-bot approved these changes 2026-10-16 00:33:34 +00:00
yuris-bot left a comment
Copy link

Code Review & Ponytail Audit Summary: Automated R2 Bucket CORS Deployment Workflow and S3 Method Compliance

1. Mechanical Verification Gate (scripts/verify-pr.mjs)

  • Passed all checks: title conventional format (fix(tiles): automated R2 bucket CORS deployment workflow and S3 method compliance), mandatory principles citations, impact framing, and anti-overengineering file path filters.

2. Ponytail Audit (Zero Bespoke Bloat)

  • S3 API Method Compliance: Removed unsupported OPTIONS method from AllowedMethods in R2_CORS_RULES. S3 PutBucketCors rejects OPTIONS with InvalidRequest because CORS preflight OPTIONS requests are evaluated server-side against AllowedMethods: ["GET", "HEAD"].
  • Automation & CI Workflows: Added dedicated Forgejo Actions workflow (.forgejo/workflows/apply-r2-cors.yml) and integrated CORS configuration step into .forgejo/workflows/sync-tiles-r2.yml.
  • Unit Testing: Added isolated unit tests in scripts/__tests__/set-r2-cors.test.ts verifying wildcard origin, methods compliance, range header exposure, and endpoint builder functions.
  • Audit verdict: Lean already. Ship.

3. Subsystem Boundary & Discipline

  • Confined strictly to backend infrastructure scripts and deployment workflows (scripts/set-r2-cors.mjs, scripts/__tests__/set-r2-cors.test.ts, .forgejo/workflows/apply-r2-cors.yml, .forgejo/workflows/sync-tiles-r2.yml). Zero frontend UI leakage.

4. Verification & Test Proofs

  • vp check: Passed 100% (295 files formatted, 0 warnings/lint errors in 130 files).
  • pnpm test: All 271 tests passed across 36 test suites.
  • next build: Next.js Turbopack production build succeeded cleanly.
  • Forgejo CI: CI / Verify Quality & Build (pull_request) passed in 1m56s.

5. Acceptance Criteria

  • Verified and checked off all acceptance criteria checkboxes on linked Issue #38.

Decision: APPROVED for squash merge into main.

### Code Review & Ponytail Audit Summary: Automated R2 Bucket CORS Deployment Workflow and S3 Method Compliance #### 1. Mechanical Verification Gate (`scripts/verify-pr.mjs`) - Passed all checks: title conventional format (`fix(tiles): automated R2 bucket CORS deployment workflow and S3 method compliance`), mandatory principles citations, impact framing, and anti-overengineering file path filters. #### 2. Ponytail Audit (Zero Bespoke Bloat) - **S3 API Method Compliance**: Removed unsupported `OPTIONS` method from `AllowedMethods` in `R2_CORS_RULES`. S3 PutBucketCors rejects `OPTIONS` with `InvalidRequest` because CORS preflight OPTIONS requests are evaluated server-side against `AllowedMethods: ["GET", "HEAD"]`. - **Automation & CI Workflows**: Added dedicated Forgejo Actions workflow (`.forgejo/workflows/apply-r2-cors.yml`) and integrated CORS configuration step into `.forgejo/workflows/sync-tiles-r2.yml`. - **Unit Testing**: Added isolated unit tests in `scripts/__tests__/set-r2-cors.test.ts` verifying wildcard origin, methods compliance, range header exposure, and endpoint builder functions. - **Audit verdict**: `Lean already. Ship.` #### 3. Subsystem Boundary & Discipline - Confined strictly to backend infrastructure scripts and deployment workflows (`scripts/set-r2-cors.mjs`, `scripts/__tests__/set-r2-cors.test.ts`, `.forgejo/workflows/apply-r2-cors.yml`, `.forgejo/workflows/sync-tiles-r2.yml`). Zero frontend UI leakage. #### 4. Verification & Test Proofs - `vp check`: Passed 100% (295 files formatted, 0 warnings/lint errors in 130 files). - `pnpm test`: All 271 tests passed across 36 test suites. - `next build`: Next.js Turbopack production build succeeded cleanly. - Forgejo CI: `CI / Verify Quality & Build (pull_request)` passed in 1m56s. #### 5. Acceptance Criteria - Verified and checked off all acceptance criteria checkboxes on linked Issue #38. **Decision**: APPROVED for squash merge into `main`.
yuris merged commit 576b108317 into main 2026-10-16 00:33:42 +00:00
yuris commented 2026-10-16 00:42:48 +00:00
Author
Owner
Copy link

Undone. Fixed by setting CORS policy on the Cloudflare R2 settings.

Undone. Fixed by setting CORS policy on the Cloudflare R2 settings.
Sign in to join this conversation.
Reviewers
No reviewers
yuris-bot
Labels
Clear labels   
backend
Backend task

  
frontend
Frontend task

No labels
backend
frontend
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
yuris/titik-gambut-next!123
No description provided.