chore(ci): replace Hardsix/action-wait-for-api with a curl poll (Node 24) - #26
Merged
Conversation
… 24) Hardsix/action-wait-for-api@v2.0.2 targets node20 and v2.0.2 is upstream's latest release, so there was nothing to bump to. It was the only Node 20 dependency left in this repo. The old call site passed only `url`, so this reproduces the action's defaults exactly: GET, succeed on 200, poll every 10s, fail after 300s. A connection failure yields 000 and keeps retrying rather than aborting, matching the action's treatment of "not reachable" as "not ready yet". The URL is passed via env rather than interpolated into the script body: deploy_marker is a workflow_call input from the calling repo, and splicing caller-controlled text into a shell script is an injection path. Nothing outside this repo calls deploy-strapi.yml, so there is no consumer to break. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes the last Node 20 dependency in this repo by replacing
Hardsix/action-wait-for-api@v2.0.2with an inlinecurlpoll.Why replace rather than bump:
v2.0.2is upstream's latest release, and it targetsnode20. There is no version to move to. Every other pin in this repo is already Node 24 — this one step would have been the only thing left when Node 20 leaves the runners in fall 2026.Behaviour is identical, by construction
The old call site passed only
url, so it ran entirely on the action's defaults. From itsaction.ymlatv2.0.2:methodGETcurldefaultexpected-status200[ "$code" = "200" ]timeout300deadline=$((SECONDS + 300))interval10sleep 10, also--max-time 10per attemptheaders,expected-response-fieldandexpected-response-field-valuewere never set, so nothing depends on them.A connection failure (backend not up yet) yields
000rather than aborting the step, so the poll keeps retrying until the deadline — matching the action, which treats "not reachable" as "not ready yet". On timeout it emits a::error::annotation with the last status seen, which is more diagnostic than what we had.The URL goes through
env, deliberatelydeploy_markeris aworkflow_callinput supplied by the calling repo. Interpolating caller-controlled text straight into arun:script body is a script-injection path, so it is passed as an environment variable instead and the script only ever references"$MARKER_URL".Blast radius
Nothing outside this repo calls
deploy-strapi.yml. I checked everyuses:line in all 42 non-archived org repos — the only references to it are internal to this file. So this cannot break a consumer today. The flip side is that it also cannot be exercised by one, and this repo'scigate is actionlint (which does shellcheckrun:blocks, so the script is linted but not executed).Part of the org-wide Node 24 action sweep — this is the last item in it.