From 10754edee678a4bbd2f48aa93e2a0c4754cca00f Mon Sep 17 00:00:00 2001 From: Arshavir Ter-Gabrielyan Date: Tue, 22 Sep 2026 12:58:25 +0000 Subject: [PATCH] ci(health): pin the Internet Identity the production probe checks The scheduled Production health run has been red on every tick for weeks, reporting "Linked Internet Identity instance" and "Internet Identity health" as failed while every MCP and OAuth check passed. Left unpinned, the status CLI learns which II to probe from the list the server advertises at /version. Production's fronting edge forwards only the MCP and OAuth paths and answers /version with a redirect to the landing site, so the probe sees no advertised II, marks the instance check failed, and the II health check has nothing to assess. The hosted production dashboard already sidesteps this: deploy.sh pins it to id.ai for exactly this reason. The off-host probe never received the same pin. Set II_ORIGIN in the job environment and pass it as --ii, mirroring how MCP_ORIGIN is supplied. Verified locally against production: unpinned, the CLI exits 1 with overall "fail" and an empty II list; pinned, it exits 0 with overall "pass" and reports the II as explicitly configured. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01TGhwpdTbUqQbR5AiiN8Ljw --- .github/workflows/health.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/health.yml b/.github/workflows/health.yml index 8a3c4a5..f7ef5d2 100644 --- a/.github/workflows/health.yml +++ b/.github/workflows/health.yml @@ -54,6 +54,14 @@ jobs: # dashboard. Without this the run fails with a usage error rather than a # health verdict, which is a confusing way to learn the service is fine. MCP_STATUS_ALLOWED_HOSTS: mcp.internetcomputer.org + # Which Internet Identity to probe. Left unpinned, the CLI reads the II + # list the server advertises at /version — but production's fronting edge + # forwards only the MCP and OAuth paths and answers /version with a + # redirect to the landing site, so the probe sees no II at all and the + # "Linked Internet Identity instance" and "Internet Identity health" + # checks fail on every tick while the service itself is healthy. Pin it, + # exactly as deploy.sh pins the hosted production dashboard. + II_ORIGIN: https://id.ai # A boolean, not the secret. The webhook itself is scoped to the one step # that posts it (below); putting it in the job environment would hand it to # every step and to the checked-out probe code, none of which needs it, and @@ -85,7 +93,7 @@ jobs: id: probe run: | set +e - node monitoring/mcp-status/cli.js --mcp "$MCP_ORIGIN" --json > report.json 2> probe.err + node monitoring/mcp-status/cli.js --mcp "$MCP_ORIGIN" --ii "$II_ORIGIN" --json > report.json 2> probe.err code=$? set -e echo "exit_code=$code" >> "$GITHUB_OUTPUT"