From 6842622da5f751010fc4d254885423bcec82cdfa Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Sat, 13 Jun 2026 02:03:00 -0700
Subject: [PATCH] ci(ui-preview): drop prod custom-domain route from the
 preview deploy config

The trusted preview config embedded the production custom domain
(routes: gittensory.aethereal.dev, custom_domain: true). It is inert under
`wrangler versions upload` (a 0%-traffic preview version applies no routes),
but it was a latent footgun: if that command were ever changed to
`wrangler deploy`, fork-built code would immediately seize the production
domain at 100% traffic. A workers.dev preview neither needs nor uses the
route, so removing it eliminates that path; a comment now warns against
re-adding it.

Defense-in-depth follow-up to the fork-safe preview pipeline (#643), flagged
by an adversarial security audit of that pipeline.
---
 .github/workflows/ui-preview-deploy.yml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ui-preview-deploy.yml b/.github/workflows/ui-preview-deploy.yml
index 240f8bca74..dc0fe3d7ca 100644
--- a/.github/workflows/ui-preview-deploy.yml
+++ b/.github/workflows/ui-preview-deploy.yml
@@ -110,7 +110,11 @@ jobs:
           echo "Artifact validated: no symlinks, expected SSR structure, allowlisted file types only."
 
       # The Wrangler config is written HERE (trusted) — never taken from the PR — so a fork cannot
-      # control bindings, routes, or vars. It points at the downloaded built bundle.
+      # control bindings, routes, or vars. It points at the downloaded built bundle. It deliberately
+      # OMITS the production custom-domain route: `wrangler versions upload` creates a 0%-traffic
+      # preview version (a workers.dev URL) and applies no routes, so the route is unused here — and
+      # omitting it guarantees that even a future switch to `wrangler deploy` could never point
+      # fork-built code at the production domain. Do not add a `routes` block to this preview config.
       - name: Write trusted preview Wrangler config
         if: steps.cfg.outputs.ready == 'true'
         run: |
@@ -138,12 +142,6 @@ jobs:
             "vars": {
               "VITE_GITTENSORY_API_ORIGIN": "https://gittensory-api.aethereal.dev"
             },
-            "routes": [
-              {
-                "pattern": "gittensory.aethereal.dev",
-                "custom_domain": true
-              }
-            ],
             "main": "index.mjs",
             "assets": {
               "binding": "ASSETS",