From afe375afdda9d16cc5c26ae9f1dd5a14802009fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20Flor=C3=AAncio?= <carlosmflorencio@gmail.com>
Date: Mon, 24 Aug 2026 18:11:20 +0000
Subject: [PATCH] fix(ci): preserve walkthrough HTML bytes (#2994)

---
 .../scripts/pr-walkthrough-workflow-contract_test.py  |  2 +-
 .github/workflows/pr-walkthrough.yml                  |  2 +-
 .../pr-walkthrough/task-04-r2-html-publication.md     | 11 +++++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/pr-walkthrough-workflow-contract_test.py b/.github/scripts/pr-walkthrough-workflow-contract_test.py
index fe8611150d..5569625cbd 100644
--- a/.github/scripts/pr-walkthrough-workflow-contract_test.py
+++ b/.github/scripts/pr-walkthrough-workflow-contract_test.py
@@ -297,7 +297,7 @@ class PRWalkthroughWorkflowContractTest(unittest.TestCase):
             'OBJECT_KEY="pr/${PR_NUMBER}/${SHORT_HEAD_SHA}.html"',
             "aws s3 cp",
             '--content-type "text/html; charset=utf-8"',
-            '--cache-control "public, max-age=300"',
+            '--cache-control "public, max-age=300, no-transform"',
             "aws s3api head-object",
             'test "$content_type" = "text/html; charset=utf-8"',
             'test "$content_length" -gt 0',
diff --git a/.github/workflows/pr-walkthrough.yml b/.github/workflows/pr-walkthrough.yml
index 3d0a81ceb4..56c767980a 100644
--- a/.github/workflows/pr-walkthrough.yml
+++ b/.github/workflows/pr-walkthrough.yml
@@ -310,7 +310,7 @@ jobs:
           aws s3 cp "$HTML_PATH" "s3://${CLOUDFLARE_R2_BUCKET}/${OBJECT_KEY}" \
             --endpoint-url "$CLOUDFLARE_R2_ENDPOINT" \
             --content-type "text/html; charset=utf-8" \
-            --cache-control "public, max-age=300" \
+            --cache-control "public, max-age=300, no-transform" \
             --only-show-errors
 
           content_type="$(aws s3api head-object \
diff --git a/docs/plans/pr-walkthrough/task-04-r2-html-publication.md b/docs/plans/pr-walkthrough/task-04-r2-html-publication.md
index 41ff6a0ec5..4218e8c131 100644
--- a/docs/plans/pr-walkthrough/task-04-r2-html-publication.md
+++ b/docs/plans/pr-walkthrough/task-04-r2-html-publication.md
@@ -81,3 +81,14 @@ Verification: workflow contract tests passed; the publication job has no
 checkout step, and R2 secrets are scoped only to the upload step. Operator
 provisioning is complete; a live upload remains pending the first eligible PR
 workflow run.
+
+Follow-up remediation: added `Cache-Control: no-transform` to the R2 upload so
+Cloudflare cannot rewrite the HTML before the public byte comparison. Updated
+the workflow contract regression to require the cache directive.
+
+Follow-up verification: `python3 .github/scripts/pr-walkthrough-workflow-contract_test.py`
+(22 tests passed), `python3 .github/scripts/lint-action-pinning_test.py` (9 tests
+passed), `python3 .github/scripts/lint-action-pinning.py` (20 workflows passed),
+and `git diff --check` passed. `zizmor` 1.25.2 retained the existing
+`dangerous-triggers` finding for the intentional `pull_request_target` workflow;
+the finding is outside this diff. `actionlint` was unavailable locally.