app deployment delta adjustments

[n1ru4l]

Background

See #7565

Description

Just merging main into #7565 so CI can run and enabling sha256 hashing for the web app persisted documents

[github-actions]

🚀 Snapshot Release (alpha)

The latest changes of this PR are available as alpha on npm (based on the declared changesets):

Package	Version	Info
@graphql-hive/cli	0.60.0-alpha-20260410113846-d6c77ced3272115e09e5ddfb1260079ed166eba5	npm ↗︎ unpkg ↗︎
hive	11.1.0-alpha-20260410113846-d6c77ced3272115e09e5ddfb1260079ed166eba5	npm ↗︎ unpkg ↗︎

[gemini-code-assist]

Code Review

This pull request introduces a v2 storage format for app deployments, adding CLI auto-detection for SHA256 hashes and API support for delta uploads and processing timings. The CDN worker now utilizes S3-based manifests to enforce version isolation for content-addressed documents. A security issue was identified where a missing manifest for a v2 deployment could bypass these isolation checks.

I am having trouble creating individual review comments. Click here to see my feedback.

packages/services/cdn-worker/src/artifact-storage-reader.ts (454-465)

For v2 deployments, if the hash manifest is not found, the version isolation check is skipped. This is a security risk as it could allow access to documents from other versions if their hash is known. It's safer to treat a missing manifest for a v2 deployment as an error and deny access.

      // Verify version isolation via manifest
      if (manifestResponse.status !== 200) {
        this.breadcrumb(
          "Version isolation: manifest not found (status=" + manifestResponse.status + ", key=" + manifestKey + ")",
        );
        return { type: 'notFound' } as const;
      }

      const manifestBody = await manifestResponse.text();
      const allowedHashes = new Set(manifestBody.split('\n').filter(Boolean));
      if (!allowedHashes.has(hash)) {
        this.breadcrumb("Version isolation: hash " + hash + " not in manifest for " + manifestKey);
        return { type: 'notFound' } as const;
      }

[github-actions]

📚 Storybook Deployment

The latest changes are available as preview in: https://pr-7969.hive-storybook.pages.dev

[github-actions]

🐋 This PR was built and pushed to the following Docker images:

Targets: build

Platforms: linux/amd64

Image Tag: d6c77ced3272115e09e5ddfb1260079ed166eba5