- Enhanced wait-for-url.sh to capture HTTP status, response time, and size on failure
- Added full response capture in release-verify.yml for debugging customer URL issues
Run 544's real cause was deeper than just "WAF rate-limit": the
upstream WAF (flights.test.aeroflot.ru) blocks the default curl UA
unconditionally, returning its HTML "Доступ временно ограничен"
page with HTTP 200. A genuine browser-like User-Agent (tested:
Chrome/120 on Linux) passes through and gets the real JSON.
Confirmed by direct upstream probe via the corp-VPN tunnel:
curl -A '<default>' → 3392b text/html (block page)
curl -A 'Mozilla/5.0 ...' → 28KB+ application/json (real data)
So every prior pre-warm "warmed" the WAF block page into the nginx
cache, and the runner was effectively never reaching the API. The
previous commit's body validation would now catch this — but only
to fail-fast, not to fix it. Real fix: send a browser UA.
Three places updated:
* scripts/ci/wait-for-url.sh — passes -A on every retry.
* ci-deploy.yml diagnose + pre-warm — UA shared via local var.
* release-verify.yml diagnose — same UA on customer-URL probes.
Note: the matching nginx config (proxy_no_cache $no_cache_html +
proxy_cache_bypass $http_cache_control on /api/dictionary/) was
deployed manually to pve-201 and verified — second hits now show
x-cache-status: HIT serving 28KB application/json. HTML responses
no longer get cached.
gnezim