fix: verify hosting response content types

2026-07-25 21:43:55 +09:00
parent eb37cbe8be
commit 18bea3a852
4 changed files with 31 additions and 5 deletions
@@ -20,6 +20,10 @@ The provider-independent cache defaults are:
 - public source maps: disabled
 - service worker/offline cache: disabled

+HTML, JSON config/manifest, and hashed JavaScript MIME types are also compared
+to the declared allowlist; a cache-correct response with a mismatched
+`Content-Type` still fails the hosting gate.
+
 `corepack pnpm verify:hosting-headers` uses a deterministic fixture locally.
 Set `HOSTING_BASE_URL` to probe deployed responses; production promotion
 requires the artifact to report `mode: "live"`.