Normalize E2E probe run IDs for stable Vercel attribution

[Copilot]

Canonical issue

Outcome

E2E requests now emit a proxy-matchable User-Agent token on every request, even if GITHUB_RUN_ID contains punctuation, whitespace, or overlong values. This preserves bounded e2e_probe_request attribution in Vercel logs without changing ordinary request handling.

Scope

• Included:
  • E2E header normalization — derive the E2E run token at request time, sanitize to [A-Za-z0-9._-], and cap to 64 chars before setting User-Agent.
  • Regression coverage — add focused tests for invalid-character normalization and length capping, alongside the existing probe-header assertions.
  • Example:

    const token = (process.env.GITHUB_RUN_ID || 'local')
      .trim()
      .replace(/[^A-Za-z0-9._-]+/g, '-')
      .replace(/^-+|-+$/g, '')
      .slice(0, 64);

• Explicitly excluded:
  • Proxy logging behavior in apps/web/src/proxy.ts
  • Workflow/auth/rate-limit behavior outside E2E attribution headers

Risk

• Risk level: low
• Failure mode:
  • E2E requests could lose log attribution if the emitted token no longer matches the proxy regex.
• Rollback:
  • Revert the tests/e2e/pipeline.test.ts harness change.

Verification

List exact automated and manual checks, tied to the current head SHA 6de619de4242.

• Focused tests
  • npx vitest run tests/e2e/pipeline.test.ts
  • npm --workspace=apps/web run test -- src/__tests__/proxy-auth-gate.test.ts
• Required CI
• Review threads resolved

Production evidence

Not directly applicable: this change tightens the E2E harness token format and validates compatibility with the existing bounded proxy log path; it does not change deploy/runtime infrastructure or introduce a new production surface.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes Attribute E2E probe requests in Vercel logs #1966

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: groupthinking/EventRelay/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6ee7fe2c-3def-4df7-8270-bac2a6db6cee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 18, 2026 9:49pm UTC

[github-actions]

🔍 PR Validation

⚠️ PR title should follow conventional commits format

[Copilot]

Copilot review overview

🟢 Approved

The implementation matches the proxy contract and includes focused regression coverage.

Review effort: Balanced
Findings: None

What changed in this PR

Normalizes E2E run IDs so attribution headers consistently match the existing Vercel proxy pattern.

Changes:

• Sanitizes and caps run IDs at 64 characters.
• Adds regression tests for normalization and truncation.

File	Description
tests/​e2e/​pipeline.test.ts	Normalizes E2E attribution tokens and tests edge cases.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Dependency Review Summary

The full dependency review summary was too large to display here (13153KB, limit is 1024KB).

Please download the artifact named "dependency-review-summary" to view the complete report.

View full job summary