ci(vercel): use VERCEL_AUTOMATION_BYPASS_SECRET in all curl checks (server, web, integration) and set Host/Accept headers

Author: aimuhire

.github/workflows/test-deploy.yml

@@ -91,6 +91,7 @@ jobs:
       VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_API_ID }}
       VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} # optional for Personal
       VERCEL_TELEMETRY_DISABLED: "1"
+      VERCEL_AUTOMATION_BYPASS_SECRET: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -118,15 +119,21 @@ jobs:
         run: |
           echo "Waiting for deployment to be ready..."
           DEPLOY_URL="${{ steps.deploy.outputs.deploy_url }}"
-          echo "Testing health at: $DEPLOY_URL/api/health"
+          HOST_HEADER=$(echo "$DEPLOY_URL" | awk -F/ '{print $3}')
+          echo "Testing health at: $DEPLOY_URL/api/health (Host: $HOST_HEADER)"
           # Initial wait to allow cold start and DNS propagation
           sleep 15
           for i in {1..30}; do
-            if curl -fsS "$DEPLOY_URL/api/health" > /dev/null; then
-              echo "✅ Server health check passed"
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+              -H "Host: $HOST_HEADER" \
+              -H "Accept: application/json" \
+              -H "x-vercel-protection-bypass: $VERCEL_AUTOMATION_BYPASS_SECRET" \
+              "$DEPLOY_URL/api/health")
+            if [ "$STATUS" = "200" ]; then
+              echo "✅ Server health check passed (200)"
               exit 0
             fi
-            echo "Attempt $i failed; retrying in 5s..."
+            echo "Attempt $i failed; status=$STATUS; retrying in 5s..."
             sleep 5
           done
           echo "❌ Server health check failed"
@@ -147,6 +154,7 @@ jobs:
       VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_WEB_ID }}
       VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} # optional
       VERCEL_TELEMETRY_DISABLED: "1"
+      VERCEL_AUTOMATION_BYPASS_SECRET: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -197,14 +205,19 @@ jobs:
         run: |
           echo "Waiting for deployment to be ready..."
           DEPLOY_URL="${{ steps.deploy-mobile.outputs.deploy_url }}"
-          echo "Testing mobile app at: $DEPLOY_URL"
+          HOST_HEADER=$(echo "$DEPLOY_URL" | awk -F/ '{print $3}')
+          echo "Testing mobile app at: $DEPLOY_URL (Host: $HOST_HEADER)"
           sleep 15
           for i in {1..30}; do
-            if curl -fsS "$DEPLOY_URL" > /dev/null; then
-              echo "✅ Mobile app health check passed"
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+              -H "Host: $HOST_HEADER" \
+              -H "x-vercel-protection-bypass: $VERCEL_AUTOMATION_BYPASS_SECRET" \
+              "$DEPLOY_URL")
+            if [ "$STATUS" = "200" ]; then
+              echo "✅ Mobile app health check passed (200)"
               exit 0
             fi
-            echo "Attempt $i failed; retrying in 5s..."
+            echo "Attempt $i failed; status=$STATUS; retrying in 5s..."
             sleep 5
           done
           echo "❌ Mobile app health check failed"
@@ -218,6 +231,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: [deploy-server, deploy-web]
     if: github.ref == 'refs/heads/main'
+    env:
+      VERCEL_AUTOMATION_BYPASS_SECRET: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
     steps:
       - uses: actions/checkout@v4
       - name: Test API endpoints
@@ -227,12 +242,16 @@ jobs:
           echo "Testing API at: $API_URL"
 
           # Test health endpoint
-          curl -f "$API_URL/api/health"
+          curl -f \
+            -H "x-vercel-protection-bypass: $VERCEL_AUTOMATION_BYPASS_SECRET" \
+            -H "Accept: application/json" \
+            "$API_URL/api/health"
           echo "✅ Health endpoint working"
 
           # Test clean endpoint
           curl -f -X POST "$API_URL/api/clean" \
             -H "Content-Type: application/json" \
+            -H "x-vercel-protection-bypass: $VERCEL_AUTOMATION_BYPASS_SECRET" \
             -d '{"url": "https://example.com?utm_source=test"}'
           echo "✅ Clean endpoint working"
 
@@ -243,11 +262,11 @@ jobs:
           echo "Testing mobile app at: $MOBILE_URL"
 
           # Test mobile app loads
-          curl -f "$MOBILE_URL"
+          curl -f -H "x-vercel-protection-bypass: $VERCEL_AUTOMATION_BYPASS_SECRET" "$MOBILE_URL"
           echo "✅ Mobile app loading"
 
           # Test mobile app assets
-          curl -f "$MOBILE_URL/manifest.json"
+          curl -f -H "x-vercel-protection-bypass: $VERCEL_AUTOMATION_BYPASS_SECRET" "$MOBILE_URL/manifest.json"
           echo "✅ Mobile app assets working"
 
       - name: Deployment summary