fix: finish staging ingest callbacks (#568)

Allow the protected staging deployment to invalidate its cache using the Vercel automation bypass, stop retrying non-transient authorization failures, suppress staging Slack alerts, and use the broader callback PAT. Add regression coverage for the branch-scoped invalidation exception.\n\n中文：修复暂存结果摄取的收尾流程。受 Vercel 保护的 staging 部署改用自动化绕过凭据刷新缓存，不再重复重试非瞬态鉴权失败；同时关闭 staging 的 Slack 告警，并使用权限更完整的 PAT 发送回调。新增分支范围鉴权例外的回归测试。

Author: cquil11

.github/workflows/ingest-agentic-results.yml

@@ -53,9 +53,6 @@ on:
       VERCEL_INVALIDATE_SECRET:
         description: Production and development cache invalidation bearer token
         required: false
-      VERCEL_STAGING_INVALIDATE_SECRET:
-        description: Staging cache invalidation bearer token
-        required: true
       VERCEL_STAGING_BYPASS_SECRET:
         description: Vercel protection automation bypass token
         required: true
@@ -128,7 +125,6 @@ jobs:
           DATABASE_WRITE_URL_DEV: ${{ secrets.DATABASE_DEV_WRITE_URL }}
           DATABASE_WRITE_URL_STAGING: ${{ secrets.DATABASE_STAGING_WRITE_URL }}
           INVALIDATE_SECRET_DEFAULT: ${{ secrets.VERCEL_INVALIDATE_SECRET }}
-          INVALIDATE_SECRET_STAGING: ${{ secrets.VERCEL_STAGING_INVALIDATE_SECRET }}
           PROTECTION_BYPASS_SECRET_STAGING: ${{ secrets.VERCEL_STAGING_BYPASS_SECRET }}
           STAGING_SITE_URL: ${{ vars.STAGING_SITE_URL || 'https://inferencemax-app-git-staging-semianalysisai.vercel.app' }}
         run: |
@@ -146,7 +142,6 @@ jobs:
             staging)
               database_write_url="$DATABASE_WRITE_URL_STAGING"
               cache_invalidate_url="${STAGING_SITE_URL%/}/api/v1/invalidate"
-              cache_invalidate_secret="$INVALIDATE_SECRET_STAGING"
               protection_bypass_secret="$PROTECTION_BYPASS_SECRET_STAGING"
               ;;
             *)
@@ -159,7 +154,7 @@ jobs:
             echo "::error::Database secret is empty for target: $REQUESTED_DATABASE_TARGET"
             exit 1
           fi
-          if [ -z "$cache_invalidate_secret" ]; then
+          if [ "$REQUESTED_DATABASE_TARGET" != "staging" ] && [ -z "$cache_invalidate_secret" ]; then
             echo "::error::Cache invalidation secret is empty for target: $REQUESTED_DATABASE_TARGET"
             exit 1
           fi
@@ -169,7 +164,9 @@ jobs:
           fi
 
           echo "::add-mask::$database_write_url"
-          echo "::add-mask::$cache_invalidate_secret"
+          if [ -n "$cache_invalidate_secret" ]; then
+            echo "::add-mask::$cache_invalidate_secret"
+          fi
           if [ -n "$protection_bypass_secret" ]; then
             echo "::add-mask::$protection_bypass_secret"
           fi
@@ -259,8 +256,7 @@ jobs:
       - name: Invalidate Vercel cache
         run: |
           if [ "$INGEST_DATABASE_TARGET" = "staging" ]; then
-            curl --retry 12 --retry-delay 10 --retry-all-errors -sSf -X POST "$CACHE_INVALIDATE_URL" \
-              -H "Authorization: Bearer $CACHE_INVALIDATE_SECRET" \
+            curl --retry 3 --retry-delay 2 --retry-connrefused -sSf -X POST "$CACHE_INVALIDATE_URL" \
               -H "x-vercel-protection-bypass: $CACHE_PROTECTION_BYPASS_SECRET"
           else
             curl -sSf -X POST "$CACHE_INVALIDATE_URL" \
@@ -293,7 +289,7 @@ jobs:
           fi
 
       - name: Notify Slack on unmapped entities
-        if: steps.unmapped.outputs.found == 'true'
+        if: steps.unmapped.outputs.found == 'true' && env.INGEST_DATABASE_TARGET != 'staging'
         uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
@@ -304,7 +300,7 @@ jobs:
             }
 
       - name: Notify Slack on failure
-        if: failure()
+        if: failure() && env.INGEST_DATABASE_TARGET != 'staging'
         uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL }}

.github/workflows/stage-results.yml

@@ -216,7 +216,6 @@ jobs:
       database-target: staging
     secrets:
       DATABASE_STAGING_WRITE_URL: ${{ secrets.DATABASE_STAGING_WRITE_URL }}
-      VERCEL_STAGING_INVALIDATE_SECRET: ${{ secrets.VERCEL_STAGING_INVALIDATE_SECRET }}
       VERCEL_STAGING_BYPASS_SECRET: ${{ secrets.VERCEL_STAGING_BYPASS_SECRET }}
       INFX_MAIN_PAT: ${{ secrets.INFX_MAIN_PAT }}
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
@@ -238,7 +237,7 @@ jobs:
           COMMENT_ID: ${{ needs.validate.outputs.comment-id }}
           STAGE_SUCCEEDED: ${{ needs['sync-staging-branch'].result == 'success' && needs['refresh-staging-database'].result == 'success' && needs.ingest.result == 'success' }}
         with:
-          github-token: ${{ secrets.INFX_MAIN_PAT }}
+          github-token: ${{ secrets.PAT }}
           script: |
             await github.rest.repos.createDispatchEvent({
               owner: 'SemiAnalysisAI',

packages/app/src/app/api/v1/invalidate/route.test.ts

@@ -11,11 +11,17 @@ vi.mock('@/lib/api-cache', () => ({
 import { POST } from './route';
 
 let origSecret: string | undefined;
+let origVercelEnv: string | undefined;
+let origVercelGitCommitRef: string | undefined;
 
 beforeEach(() => {
   vi.clearAllMocks();
   origSecret = process.env.INVALIDATE_SECRET;
+  origVercelEnv = process.env.VERCEL_ENV;
+  origVercelGitCommitRef = process.env.VERCEL_GIT_COMMIT_REF;
   process.env.INVALIDATE_SECRET = 'test-secret-123';
+  delete process.env.VERCEL_ENV;
+  delete process.env.VERCEL_GIT_COMMIT_REF;
 });
 
 afterEach(() => {
@@ -24,6 +30,16 @@ afterEach(() => {
   } else {
     process.env.INVALIDATE_SECRET = origSecret;
   }
+  if (origVercelEnv === undefined) {
+    delete process.env.VERCEL_ENV;
+  } else {
+    process.env.VERCEL_ENV = origVercelEnv;
+  }
+  if (origVercelGitCommitRef === undefined) {
+    delete process.env.VERCEL_GIT_COMMIT_REF;
+  } else {
+    process.env.VERCEL_GIT_COMMIT_REF = origVercelGitCommitRef;
+  }
 });
 
 function postReq(headers?: Record<string, string>): Request {
@@ -58,6 +74,38 @@ describe('POST /api/v1/invalidate', () => {
     expect(res.status).toBe(401);
   });
 
+  it('allows the Vercel-protected staging branch with an automation bypass', async () => {
+    process.env.VERCEL_ENV = 'preview';
+    process.env.VERCEL_GIT_COMMIT_REF = 'staging';
+    mockPurgeAll.mockResolvedValueOnce(4);
+
+    const res = await POST(postReq({ 'x-vercel-protection-bypass': 'opaque-bypass' }));
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ invalidated: true, blobsDeleted: 4 });
+    expect(mockPurgeAll).toHaveBeenCalledOnce();
+  });
+
+  it('still requires app auth for non-staging preview branches', async () => {
+    process.env.VERCEL_ENV = 'preview';
+    process.env.VERCEL_GIT_COMMIT_REF = 'feature-branch';
+
+    const res = await POST(postReq({ 'x-vercel-protection-bypass': 'opaque-bypass' }));
+
+    expect(res.status).toBe(401);
+    expect(mockPurgeAll).not.toHaveBeenCalled();
+  });
+
+  it('still requires app auth when staging has no automation bypass header', async () => {
+    process.env.VERCEL_ENV = 'preview';
+    process.env.VERCEL_GIT_COMMIT_REF = 'staging';
+
+    const res = await POST(postReq());
+
+    expect(res.status).toBe(401);
+    expect(mockPurgeAll).not.toHaveBeenCalled();
+  });
+
   it('invalidates cache with correct auth', async () => {
     mockPurgeAll.mockResolvedValueOnce(15);
 

packages/app/src/app/api/v1/invalidate/route.ts

@@ -8,11 +8,21 @@ export async function POST(request: Request) {
   const secret = process.env.INVALIDATE_SECRET;
   const authHeader = request.headers.get('Authorization') ?? '';
   const expected = `Bearer ${secret}`;
+  // The shared staging deployment is already protected by Vercel. Its CI
+  // caller must present the project-scoped automation bypass before Vercel
+  // forwards this header to the route, so a second app secret is redundant.
+  // Keep this exception branch-specific; production and every other preview
+  // continue to require INVALIDATE_SECRET below.
+  const isProtectedStagingRequest =
+    process.env.VERCEL_ENV === 'preview' &&
+    process.env.VERCEL_GIT_COMMIT_REF === 'staging' &&
+    Boolean(request.headers.get('x-vercel-protection-bypass'));
 
   if (
-    !secret ||
-    authHeader.length !== expected.length ||
-    !timingSafeEqual(Buffer.from(authHeader), Buffer.from(expected))
+    !isProtectedStagingRequest &&
+    (!secret ||
+      authHeader.length !== expected.length ||
+      !timingSafeEqual(Buffer.from(authHeader), Buffer.from(expected)))
   ) {
     return new NextResponse('Unauthorized', { status: 401 });
   }