ci(e2e): report captcha drift in staging instance validation - #8832

Closed
jacekradko wants to merge 1 commit into
mainfrom
jacek/staging-validator-captcha-drift
Closed

ci(e2e): report captcha drift in staging instance validation#8832
jacekradko wants to merge 1 commit into
mainfrom
jacek/staging-validator-captcha-drift

Conversation

@jacekradko

@jacekradkojacekradko commented Jun 11, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

The staging-instance validator has been ignoring captcha_enabled and captcha_widget_type as "expected to differ", which is exactly how the Turnstile drift that kept the staging generic leg red for a week stayed invisible (legal-consent sign-ups blocked on an unsolvable headless captcha, see run 27344100979). Bot protection changes e2e behavior, so it belongs in the comparison.

The script is report-only on main, so this only surfaces drift. A live run currently flags ~11 staging instances with captcha on while their prod counterparts have it off; 5 others have it on in both environments and correctly report as matched.

Summary by CodeRabbit

Release Notes

  • Tests

    • Added test coverage for environment validation logic.

  • Chores

    • Updated environment validation configuration to adjust which settings are compared between staging and production deployments.

@vercel

vercelBot commented Jun 11, 2026•
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:35pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:35pm

Request Review

@changeset-bot

changeset-botBot commented Jun 11, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: a3bf419

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitaiBot commented Jun 11, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 0310b799-cb9c-4876-a123-bc50ca2ec066

📥 Commits

Reviewing files that changed from the base of the PR and between d0ed42f and a3bf419.

📒 Files selected for processing (3)
  • .changeset/heavy-pugs-warn.md
  • scripts/validate-staging-instances.mjs
  • scripts/validate-staging-instances.test.mjs
📝 Walkthrough

Walkthrough

The PR updates staging-vs-production environment validation by replacing captcha-related path filters with HIBP-related filters in IGNORED_PATHS, exports the isIgnored function for direct testing, and adds a test suite verifying the updated filtering logic and existing ignored patterns.

Changes

Staging Validation Updates

Layer / File(s)Summary
Ignored paths and API exports
scripts/validate-staging-instances.mjs, .changeset/heavy-pugs-warn.md		IGNORED_PATHS configuration removes /.captcha_enabled$/ and /.captcha_widget_type$/ patterns and adds /.enforce_hibp_on_sign_in$/ and /.disable_hibp$/ instead. The isIgnored function is added to named exports to enable direct testing.
isIgnored function tests
scripts/validate-staging-instances.test.mjs		New test suite verifies that captcha-related settings are not ignored, while ID, logo_url, and HIBP-related keys remain in the ignored set.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 Paths to ignore, now rewritten clean,
Captcha departs, HIBP takes the scene,
Tests confirm what gets filtered away,
Staging snapshots match prod today!
Exported and proven, the validation's bright,
Configuration dances with tests held tight. ✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title directly describes the main change: updating the staging instance validator to report (stop ignoring) captcha-related drift.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands and usage tips.

@jacekradkojacekradko mentioned this pull request Jun 11, 2026
Merged
@pkg-pr-new

pkg-pr-newBot commented Jun 11, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8832

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8832

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8832

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8832

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8832

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8832

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8832

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8832

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8832

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8832

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8832

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8832

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8832

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8832

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8832

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8832

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8832

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8832

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8832

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8832

commit: a3bf419

@jacekradko

jacekradko commented Jun 11, 2026

Copy link
Copy Markdown
ContributorAuthor

Superseded by #8757 (merged as 09054eb), which carried this change in full so the two could land in either order. Everything here (captcha ignore-removal, isIgnored export, tests) is already on main.

@jacekradko
jacekradko deleted the jacek/staging-validator-captcha-drift branch June 11, 2026 21:54
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
ci(e2e): report captcha drift in staging instance validation - #8832
Closed
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Closed
ci(e2e): report captcha drift in staging instance validation#8832
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 11, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
The staging-instance validator has been ignoring captcha_enabled and captcha_widget_type as "expected to differ", which is exactly how the Turnstile drift that kept the staging generic leg red for a week stayed invisible (legal-consent sign-ups blocked on an unsolvable headless captcha, see run 27344100979). Bot protection changes e2e behavior, so it belongs in the comparison.
The script is report-only on main, so this only surfaces drift. A live run currently flags ~11 staging instances with captcha on while their prod counterparts have it off; 5 others have it on in both environments and correctly report as matched.
Summary by CodeRabbit
Release Notes
  • Tests
    • Added test coverage for environment validation logic.
  • Chores
    • Updated environment validation configuration to adjust which settings are compared between staging and production deployments.
@vercel
vercelBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:35pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:35pm
Request Review
@changeset-bot
changeset-botBot
commented
Jun 11, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: a3bf419
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@coderabbitai
coderabbitaiBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 0310b799-cb9c-4876-a123-bc50ca2ec066
📥 Commits
Reviewing files that changed from the base of the PR and between d0ed42f and a3bf419.
📒 Files selected for processing (3)
  • .changeset/heavy-pugs-warn.md
  • scripts/validate-staging-instances.mjs
  • scripts/validate-staging-instances.test.mjs
📝 Walkthrough
Walkthrough
The PR updates staging-vs-production environment validation by replacing captcha-related path filters with HIBP-related filters in IGNORED_PATHS, exports the isIgnored function for direct testing, and adds a test suite verifying the updated filtering logic and existing ignored patterns.
Changes
Staging Validation Updates
Layer / File(s)Summary
Ignored paths and API exports
scripts/validate-staging-instances.mjs, .changeset/heavy-pugs-warn.md		IGNORED_PATHS configuration removes /.captcha_enabled$/ and /.captcha_widget_type$/ patterns and adds /.enforce_hibp_on_sign_in$/ and /.disable_hibp$/ instead. The isIgnored function is added to named exports to enable direct testing.
isIgnored function tests
scripts/validate-staging-instances.test.mjs		New test suite verifies that captcha-related settings are not ignored, while ID, logo_url, and HIBP-related keys remain in the ignored set.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~8 minutes
Poem
🐰 Paths to ignore, now rewritten clean,

Captcha departs, HIBP takes the scene,

Tests confirm what gets filtered away,

Staging snapshots match prod today!

Exported and proven, the validation's bright,

Configuration dances with tests held tight. ✨
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title directly describes the main change: updating the staging instance validator to report (stop ignoring) captcha-related drift.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Comment @coderabbitai help to get the list of available commands and usage tips.
@jacekradkojacekradko
mentioned this pull request
Jun 11, 2026
 Merged

@pkg-pr-new
pkg-pr-newBot
commented
Jun 11, 2026

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8832

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8832

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8832

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8832

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8832

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8832

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8832

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8832

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8832

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8832

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8832

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8832

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8832

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8832

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8832

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8832

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8832

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8832

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8832

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8832

commit: a3bf419
@jacekradko
jacekradko
commented
Jun 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by #8757 (merged as 09054eb), which carried this change in full so the two could land in either order. Everything here (captcha ignore-removal, isIgnored export, tests) is already on main.
@jacekradko
jacekradko
deleted the

jacek/staging-validator-captcha-drift

branch
June 11, 2026 21:54
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
ci(e2e): report captcha drift in staging instance validation - #8832
Closed
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Closed
ci(e2e): report captcha drift in staging instance validation#8832
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 11, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
The staging-instance validator has been ignoring captcha_enabled and captcha_widget_type as "expected to differ", which is exactly how the Turnstile drift that kept the staging generic leg red for a week stayed invisible (legal-consent sign-ups blocked on an unsolvable headless captcha, see run 27344100979). Bot protection changes e2e behavior, so it belongs in the comparison.
The script is report-only on main, so this only surfaces drift. A live run currently flags ~11 staging instances with captcha on while their prod counterparts have it off; 5 others have it on in both environments and correctly report as matched.
Summary by CodeRabbit
Release Notes
  • Tests
    • Added test coverage for environment validation logic.
  • Chores
    • Updated environment validation configuration to adjust which settings are compared between staging and production deployments.
@vercel
vercelBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:35pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:35pm
Request Review
@changeset-bot
changeset-botBot
commented
Jun 11, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: a3bf419
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@coderabbitai
coderabbitaiBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 0310b799-cb9c-4876-a123-bc50ca2ec066
📥 Commits
Reviewing files that changed from the base of the PR and between d0ed42f and a3bf419.
📒 Files selected for processing (3)
  • .changeset/heavy-pugs-warn.md
  • scripts/validate-staging-instances.mjs
  • scripts/validate-staging-instances.test.mjs
📝 Walkthrough
Walkthrough
The PR updates staging-vs-production environment validation by replacing captcha-related path filters with HIBP-related filters in IGNORED_PATHS, exports the isIgnored function for direct testing, and adds a test suite verifying the updated filtering logic and existing ignored patterns.
Changes
Staging Validation Updates
Layer / File(s)Summary
Ignored paths and API exports
scripts/validate-staging-instances.mjs, .changeset/heavy-pugs-warn.md		IGNORED_PATHS configuration removes /.captcha_enabled$/ and /.captcha_widget_type$/ patterns and adds /.enforce_hibp_on_sign_in$/ and /.disable_hibp$/ instead. The isIgnored function is added to named exports to enable direct testing.
isIgnored function tests
scripts/validate-staging-instances.test.mjs		New test suite verifies that captcha-related settings are not ignored, while ID, logo_url, and HIBP-related keys remain in the ignored set.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~8 minutes
Poem
🐰 Paths to ignore, now rewritten clean,

Captcha departs, HIBP takes the scene,

Tests confirm what gets filtered away,

Staging snapshots match prod today!

Exported and proven, the validation's bright,

Configuration dances with tests held tight. ✨
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title directly describes the main change: updating the staging instance validator to report (stop ignoring) captcha-related drift.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Comment @coderabbitai help to get the list of available commands and usage tips.
@jacekradkojacekradko
mentioned this pull request
Jun 11, 2026
 Merged

@pkg-pr-new
pkg-pr-newBot
commented
Jun 11, 2026

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8832

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8832

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8832

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8832

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8832

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8832

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8832

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8832

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8832

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8832

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8832

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8832

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8832

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8832

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8832

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8832

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8832

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8832

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8832

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8832

commit: a3bf419
@jacekradko
jacekradko
commented
Jun 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by #8757 (merged as 09054eb), which carried this change in full so the two could land in either order. Everything here (captcha ignore-removal, isIgnored export, tests) is already on main.
@jacekradko
jacekradko
deleted the

jacek/staging-validator-captcha-drift

branch
June 11, 2026 21:54
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
ci(e2e): report captcha drift in staging instance validation - #8832
Closed
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Closed
ci(e2e): report captcha drift in staging instance validation#8832
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 11, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
The staging-instance validator has been ignoring captcha_enabled and captcha_widget_type as "expected to differ", which is exactly how the Turnstile drift that kept the staging generic leg red for a week stayed invisible (legal-consent sign-ups blocked on an unsolvable headless captcha, see run 27344100979). Bot protection changes e2e behavior, so it belongs in the comparison.
The script is report-only on main, so this only surfaces drift. A live run currently flags ~11 staging instances with captcha on while their prod counterparts have it off; 5 others have it on in both environments and correctly report as matched.
Summary by CodeRabbit
Release Notes
  • Tests
    • Added test coverage for environment validation logic.
  • Chores
    • Updated environment validation configuration to adjust which settings are compared between staging and production deployments.
@vercel
vercelBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:35pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:35pm
Request Review
@changeset-bot
changeset-botBot
commented
Jun 11, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: a3bf419
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@coderabbitai
coderabbitaiBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 0310b799-cb9c-4876-a123-bc50ca2ec066
📥 Commits
Reviewing files that changed from the base of the PR and between d0ed42f and a3bf419.
📒 Files selected for processing (3)
  • .changeset/heavy-pugs-warn.md
  • scripts/validate-staging-instances.mjs
  • scripts/validate-staging-instances.test.mjs
📝 Walkthrough
Walkthrough
The PR updates staging-vs-production environment validation by replacing captcha-related path filters with HIBP-related filters in IGNORED_PATHS, exports the isIgnored function for direct testing, and adds a test suite verifying the updated filtering logic and existing ignored patterns.
Changes
Staging Validation Updates
Layer / File(s)Summary
Ignored paths and API exports
scripts/validate-staging-instances.mjs, .changeset/heavy-pugs-warn.md		IGNORED_PATHS configuration removes /.captcha_enabled$/ and /.captcha_widget_type$/ patterns and adds /.enforce_hibp_on_sign_in$/ and /.disable_hibp$/ instead. The isIgnored function is added to named exports to enable direct testing.
isIgnored function tests
scripts/validate-staging-instances.test.mjs		New test suite verifies that captcha-related settings are not ignored, while ID, logo_url, and HIBP-related keys remain in the ignored set.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~8 minutes
Poem
🐰 Paths to ignore, now rewritten clean,

Captcha departs, HIBP takes the scene,

Tests confirm what gets filtered away,

Staging snapshots match prod today!

Exported and proven, the validation's bright,

Configuration dances with tests held tight. ✨
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title directly describes the main change: updating the staging instance validator to report (stop ignoring) captcha-related drift.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Comment @coderabbitai help to get the list of available commands and usage tips.
@jacekradkojacekradko
mentioned this pull request
Jun 11, 2026
 Merged

@pkg-pr-new
pkg-pr-newBot
commented
Jun 11, 2026

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8832

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8832

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8832

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8832

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8832

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8832

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8832

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8832

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8832

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8832

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8832

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8832

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8832

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8832

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8832

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8832

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8832

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8832

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8832

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8832

commit: a3bf419
@jacekradko
jacekradko
commented
Jun 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by #8757 (merged as 09054eb), which carried this change in full so the two could land in either order. Everything here (captcha ignore-removal, isIgnored export, tests) is already on main.
@jacekradko
jacekradko
deleted the

jacek/staging-validator-captcha-drift

branch
June 11, 2026 21:54
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
ci(e2e): report captcha drift in staging instance validation - #8832
Closed
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Closed
ci(e2e): report captcha drift in staging instance validation#8832
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 11, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
The staging-instance validator has been ignoring captcha_enabled and captcha_widget_type as "expected to differ", which is exactly how the Turnstile drift that kept the staging generic leg red for a week stayed invisible (legal-consent sign-ups blocked on an unsolvable headless captcha, see run 27344100979). Bot protection changes e2e behavior, so it belongs in the comparison.
The script is report-only on main, so this only surfaces drift. A live run currently flags ~11 staging instances with captcha on while their prod counterparts have it off; 5 others have it on in both environments and correctly report as matched.
Summary by CodeRabbit
Release Notes
  • Tests
    • Added test coverage for environment validation logic.
  • Chores
    • Updated environment validation configuration to adjust which settings are compared between staging and production deployments.
@vercel
vercelBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:35pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:35pm
Request Review
@changeset-bot
changeset-botBot
commented
Jun 11, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: a3bf419
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@coderabbitai
coderabbitaiBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 0310b799-cb9c-4876-a123-bc50ca2ec066
📥 Commits
Reviewing files that changed from the base of the PR and between d0ed42f and a3bf419.
📒 Files selected for processing (3)
  • .changeset/heavy-pugs-warn.md
  • scripts/validate-staging-instances.mjs
  • scripts/validate-staging-instances.test.mjs
📝 Walkthrough
Walkthrough
The PR updates staging-vs-production environment validation by replacing captcha-related path filters with HIBP-related filters in IGNORED_PATHS, exports the isIgnored function for direct testing, and adds a test suite verifying the updated filtering logic and existing ignored patterns.
Changes
Staging Validation Updates
Layer / File(s)Summary
Ignored paths and API exports
scripts/validate-staging-instances.mjs, .changeset/heavy-pugs-warn.md		IGNORED_PATHS configuration removes /.captcha_enabled$/ and /.captcha_widget_type$/ patterns and adds /.enforce_hibp_on_sign_in$/ and /.disable_hibp$/ instead. The isIgnored function is added to named exports to enable direct testing.
isIgnored function tests
scripts/validate-staging-instances.test.mjs		New test suite verifies that captcha-related settings are not ignored, while ID, logo_url, and HIBP-related keys remain in the ignored set.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~8 minutes
Poem
🐰 Paths to ignore, now rewritten clean,

Captcha departs, HIBP takes the scene,

Tests confirm what gets filtered away,

Staging snapshots match prod today!

Exported and proven, the validation's bright,

Configuration dances with tests held tight. ✨
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title directly describes the main change: updating the staging instance validator to report (stop ignoring) captcha-related drift.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Comment @coderabbitai help to get the list of available commands and usage tips.
@jacekradkojacekradko
mentioned this pull request
Jun 11, 2026
 Merged

@pkg-pr-new
pkg-pr-newBot
commented
Jun 11, 2026

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8832

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8832

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8832

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8832

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8832

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8832

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8832

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8832

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8832

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8832

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8832

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8832

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8832

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8832

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8832

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8832

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8832

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8832

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8832

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8832

commit: a3bf419
@jacekradko
jacekradko
commented
Jun 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by #8757 (merged as 09054eb), which carried this change in full so the two could land in either order. Everything here (captcha ignore-removal, isIgnored export, tests) is already on main.
@jacekradko
jacekradko
deleted the

jacek/staging-validator-captcha-drift

branch
June 11, 2026 21:54
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
ci(e2e): report captcha drift in staging instance validation - #8832
Closed
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Closed
ci(e2e): report captcha drift in staging instance validation#8832
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 11, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
The staging-instance validator has been ignoring captcha_enabled and captcha_widget_type as "expected to differ", which is exactly how the Turnstile drift that kept the staging generic leg red for a week stayed invisible (legal-consent sign-ups blocked on an unsolvable headless captcha, see run 27344100979). Bot protection changes e2e behavior, so it belongs in the comparison.
The script is report-only on main, so this only surfaces drift. A live run currently flags ~11 staging instances with captcha on while their prod counterparts have it off; 5 others have it on in both environments and correctly report as matched.
Summary by CodeRabbit
Release Notes
  • Tests
    • Added test coverage for environment validation logic.
  • Chores
    • Updated environment validation configuration to adjust which settings are compared between staging and production deployments.
@vercel
vercelBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:35pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:35pm
Request Review
@changeset-bot
changeset-botBot
commented
Jun 11, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: a3bf419
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@coderabbitai
coderabbitaiBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 0310b799-cb9c-4876-a123-bc50ca2ec066
📥 Commits
Reviewing files that changed from the base of the PR and between d0ed42f and a3bf419.
📒 Files selected for processing (3)
  • .changeset/heavy-pugs-warn.md
  • scripts/validate-staging-instances.mjs
  • scripts/validate-staging-instances.test.mjs
📝 Walkthrough
Walkthrough
The PR updates staging-vs-production environment validation by replacing captcha-related path filters with HIBP-related filters in IGNORED_PATHS, exports the isIgnored function for direct testing, and adds a test suite verifying the updated filtering logic and existing ignored patterns.
Changes
Staging Validation Updates
Layer / File(s)Summary
Ignored paths and API exports
scripts/validate-staging-instances.mjs, .changeset/heavy-pugs-warn.md		IGNORED_PATHS configuration removes /.captcha_enabled$/ and /.captcha_widget_type$/ patterns and adds /.enforce_hibp_on_sign_in$/ and /.disable_hibp$/ instead. The isIgnored function is added to named exports to enable direct testing.
isIgnored function tests
scripts/validate-staging-instances.test.mjs		New test suite verifies that captcha-related settings are not ignored, while ID, logo_url, and HIBP-related keys remain in the ignored set.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~8 minutes
Poem
🐰 Paths to ignore, now rewritten clean,

Captcha departs, HIBP takes the scene,

Tests confirm what gets filtered away,

Staging snapshots match prod today!

Exported and proven, the validation's bright,

Configuration dances with tests held tight. ✨
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title directly describes the main change: updating the staging instance validator to report (stop ignoring) captcha-related drift.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Comment @coderabbitai help to get the list of available commands and usage tips.
@jacekradkojacekradko
mentioned this pull request
Jun 11, 2026
 Merged

@pkg-pr-new
pkg-pr-newBot
commented
Jun 11, 2026

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8832

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8832

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8832

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8832

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8832

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8832

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8832

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8832

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8832

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8832

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8832

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8832

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8832

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8832

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8832

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8832

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8832

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8832

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8832

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8832

commit: a3bf419
@jacekradko
jacekradko
commented
Jun 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by #8757 (merged as 09054eb), which carried this change in full so the two could land in either order. Everything here (captcha ignore-removal, isIgnored export, tests) is already on main.
@jacekradko
jacekradko
deleted the

jacek/staging-validator-captcha-drift

branch
June 11, 2026 21:54
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
ci(e2e): report captcha drift in staging instance validation - #8832
Closed
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Closed
ci(e2e): report captcha drift in staging instance validation#8832
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 11, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
The staging-instance validator has been ignoring captcha_enabled and captcha_widget_type as "expected to differ", which is exactly how the Turnstile drift that kept the staging generic leg red for a week stayed invisible (legal-consent sign-ups blocked on an unsolvable headless captcha, see run 27344100979). Bot protection changes e2e behavior, so it belongs in the comparison.
The script is report-only on main, so this only surfaces drift. A live run currently flags ~11 staging instances with captcha on while their prod counterparts have it off; 5 others have it on in both environments and correctly report as matched.
Summary by CodeRabbit
Release Notes
  • Tests
    • Added test coverage for environment validation logic.
  • Chores
    • Updated environment validation configuration to adjust which settings are compared between staging and production deployments.
@vercel
vercelBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:35pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:35pm
Request Review
@changeset-bot
changeset-botBot
commented
Jun 11, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: a3bf419
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@coderabbitai
coderabbitaiBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 0310b799-cb9c-4876-a123-bc50ca2ec066
📥 Commits
Reviewing files that changed from the base of the PR and between d0ed42f and a3bf419.
📒 Files selected for processing (3)
  • .changeset/heavy-pugs-warn.md
  • scripts/validate-staging-instances.mjs
  • scripts/validate-staging-instances.test.mjs
📝 Walkthrough
Walkthrough
The PR updates staging-vs-production environment validation by replacing captcha-related path filters with HIBP-related filters in IGNORED_PATHS, exports the isIgnored function for direct testing, and adds a test suite verifying the updated filtering logic and existing ignored patterns.
Changes
Staging Validation Updates
Layer / File(s)Summary
Ignored paths and API exports
scripts/validate-staging-instances.mjs, .changeset/heavy-pugs-warn.md		IGNORED_PATHS configuration removes /.captcha_enabled$/ and /.captcha_widget_type$/ patterns and adds /.enforce_hibp_on_sign_in$/ and /.disable_hibp$/ instead. The isIgnored function is added to named exports to enable direct testing.
isIgnored function tests
scripts/validate-staging-instances.test.mjs		New test suite verifies that captcha-related settings are not ignored, while ID, logo_url, and HIBP-related keys remain in the ignored set.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~8 minutes
Poem
🐰 Paths to ignore, now rewritten clean,

Captcha departs, HIBP takes the scene,

Tests confirm what gets filtered away,

Staging snapshots match prod today!

Exported and proven, the validation's bright,

Configuration dances with tests held tight. ✨
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title directly describes the main change: updating the staging instance validator to report (stop ignoring) captcha-related drift.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Comment @coderabbitai help to get the list of available commands and usage tips.
@jacekradkojacekradko
mentioned this pull request
Jun 11, 2026
 Merged

@pkg-pr-new
pkg-pr-newBot
commented
Jun 11, 2026

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8832

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8832

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8832

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8832

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8832

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8832

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8832

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8832

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8832

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8832

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8832

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8832

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8832

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8832

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8832

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8832

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8832

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8832

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8832

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8832

commit: a3bf419
@jacekradko
jacekradko
commented
Jun 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by #8757 (merged as 09054eb), which carried this change in full so the two could land in either order. Everything here (captcha ignore-removal, isIgnored export, tests) is already on main.
@jacekradko
jacekradko
deleted the

jacek/staging-validator-captcha-drift

branch
June 11, 2026 21:54
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
ci(e2e): report captcha drift in staging instance validation - #8832
Closed
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Closed
ci(e2e): report captcha drift in staging instance validation#8832
jacekradko wants to merge 1 commit into
mainfrom 
jacek/staging-validator-captcha-drift
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 11, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
The staging-instance validator has been ignoring captcha_enabled and captcha_widget_type as "expected to differ", which is exactly how the Turnstile drift that kept the staging generic leg red for a week stayed invisible (legal-consent sign-ups blocked on an unsolvable headless captcha, see run 27344100979). Bot protection changes e2e behavior, so it belongs in the comparison.
The script is report-only on main, so this only surfaces drift. A live run currently flags ~11 staging instances with captcha on while their prod counterparts have it off; 5 others have it on in both environments and correctly report as matched.
Summary by CodeRabbit
Release Notes
  • Tests
    • Added test coverage for environment validation logic.
  • Chores
    • Updated environment validation configuration to adjust which settings are compared between staging and production deployments.
@vercel
vercelBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:35pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:35pm
Request Review
@changeset-bot
changeset-botBot
commented
Jun 11, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: a3bf419
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@coderabbitai
coderabbitaiBot
commented
Jun 11, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 0310b799-cb9c-4876-a123-bc50ca2ec066
📥 Commits
Reviewing files that changed from the base of the PR and between d0ed42f and a3bf419.
📒 Files selected for processing (3)
  • .changeset/heavy-pugs-warn.md
  • scripts/validate-staging-instances.mjs
  • scripts/validate-staging-instances.test.mjs
📝 Walkthrough
Walkthrough
The PR updates staging-vs-production environment validation by replacing captcha-related path filters with HIBP-related filters in IGNORED_PATHS, exports the isIgnored function for direct testing, and adds a test suite verifying the updated filtering logic and existing ignored patterns.
Changes
Staging Validation Updates
Layer / File(s)Summary
Ignored paths and API exports
scripts/validate-staging-instances.mjs, .changeset/heavy-pugs-warn.md		IGNORED_PATHS configuration removes /.captcha_enabled$/ and /.captcha_widget_type$/ patterns and adds /.enforce_hibp_on_sign_in$/ and /.disable_hibp$/ instead. The isIgnored function is added to named exports to enable direct testing.
isIgnored function tests
scripts/validate-staging-instances.test.mjs		New test suite verifies that captcha-related settings are not ignored, while ID, logo_url, and HIBP-related keys remain in the ignored set.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~8 minutes
Poem
🐰 Paths to ignore, now rewritten clean,

Captcha departs, HIBP takes the scene,

Tests confirm what gets filtered away,

Staging snapshots match prod today!

Exported and proven, the validation's bright,

Configuration dances with tests held tight. ✨
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title directly describes the main change: updating the staging instance validator to report (stop ignoring) captcha-related drift.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Comment @coderabbitai help to get the list of available commands and usage tips.
@jacekradkojacekradko
mentioned this pull request
Jun 11, 2026
 Merged

@pkg-pr-new
pkg-pr-newBot
commented
Jun 11, 2026

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8832

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8832

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8832

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8832

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8832

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8832

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8832

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8832

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8832

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8832

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8832

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8832

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8832

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8832

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8832

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8832

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8832

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8832

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8832

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8832

commit: a3bf419
@jacekradko
jacekradko
commented
Jun 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by #8757 (merged as 09054eb), which carried this change in full so the two could land in either order. Everything here (captcha ignore-removal, isIgnored export, tests) is already on main.
@jacekradko
jacekradko
deleted the

jacek/staging-validator-captcha-drift

branch
June 11, 2026 21:54
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano