Observation
The container smoke in .github/workflows/handbook-build-check.yaml probes assembled screenshots and legal downloads through the Basic-Auth gate and accepts HTTP 401 as proof the file exists ("auth fails but file exists"). That proof does not hold: auth_basic in handbook.nginx.conf runs in nginx's access phase, before any file lookup, and the probe's credentials fall back to x:x because HANDBOOK_USER/HANDBOOK_PASS are never set in the workflow. A request for a missing file returns the same 401 as one for an existing file, so the per-asset probes verify only that nginx answers.
Practical impact is limited — per-file existence is already proven earlier in the job by the assembly steps and their count guards — but the probes suggest coverage they do not provide. Surfaced during the #892 review passes; the comments were reworded there to stop overstating the smoke, the probe mechanics themselves were left as-is.
Proposal
Either supply valid smoke credentials (workflow-level env from a secret) and require HTTP 200 for the sampled assets, or assert existence inside the container (docker exec <name> test -f /usr/share/nginx/html/screenshots/<sample>.png) and drop the 401-tolerant asset probes. The plain /de/ 401 check (auth wall present) stays as is.
Repro sketch: build the image, run it, then curl -u x:x .../screenshots/definitely-missing.png — it answers 401, not 404.
Observation
The container smoke in
.github/workflows/handbook-build-check.yamlprobes assembled screenshots and legal downloads through the Basic-Auth gate and accepts HTTP 401 as proof the file exists ("auth fails but file exists"). That proof does not hold:auth_basicinhandbook.nginx.confruns in nginx's access phase, before any file lookup, and the probe's credentials fall back tox:xbecauseHANDBOOK_USER/HANDBOOK_PASSare never set in the workflow. A request for a missing file returns the same 401 as one for an existing file, so the per-asset probes verify only that nginx answers.Practical impact is limited — per-file existence is already proven earlier in the job by the assembly steps and their count guards — but the probes suggest coverage they do not provide. Surfaced during the #892 review passes; the comments were reworded there to stop overstating the smoke, the probe mechanics themselves were left as-is.
Proposal
Either supply valid smoke credentials (workflow-level
envfrom a secret) and require HTTP 200 for the sampled assets, or assert existence inside the container (docker exec <name> test -f /usr/share/nginx/html/screenshots/<sample>.png) and drop the 401-tolerant asset probes. The plain/de/401 check (auth wall present) stays as is.Repro sketch: build the image, run it, then
curl -u x:x .../screenshots/definitely-missing.png— it answers 401, not 404.