Release Integrity Auditor

Verify that a deployed static release is the build you expected — not merely a URL that returns HTTP 200.

The Actor compares an expected manifest against the bytes actually served by the remote site. It verifies decoded response SHA-256 and size, and can enforce MIME type, CORS, and cache policy.

What it detects

• missing or non-2xx release assets
• stale or wrong bytes behind a CDN/cache
• wrong decoded size or SHA-256
• incorrect MIME type
• missing or incorrect CORS policy
• immutable-cache mistakes on entrypoints
• missing immutable cache policy on hashed assets
• redirect/fetch failures that make the result incomplete

gzip, Brotli, and deflate responses are hashed after decoding, so the digest represents the build artifact rather than transfer encoding.

Network safety

The public Actor only accepts public HTTP(S) targets. It rejects loopback, link-local, RFC1918, CGNAT, documentation/reserved address ranges, IPv6 ULA, and metadata-style private targets. DNS results are validated before connecting and every redirect target is validated again.

Responses are streamed with per-object and per-run transfer/decoded byte limits. Arbitrary request headers, cookies, credentials, and browser execution are not supported.

Input manifest

{
  "schemaVersion": 1,
  "baseUrl": "https://example.com/releases/abc/",
  "files": [
    {
      "path": "index.html",
      "sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "size": 1234,
      "contentType": "text/html",
      "cache": "entrypoint"
    }
  ],
  "release": {
    "id": "abc"
  }
}

cache may be entrypoint, immutable, or any. cors may be same-origin, *, or an exact expected origin.

Output

One receipt is written to the default Dataset and a compact summary to SUMMARY. The receipt has an overall status:

• PASS — every requested verification completed and matched.
• FAIL — at least one completed verification proved a mismatch.
• INCOMPLETE — one or more objects could not be verified.

Receipts include stable finding codes, transfer counters, normalized input/rules digests, and a deterministic receipt digest.

Monetization

Successful PASS receipts use one predictable PPE event selected from the expected manifest scope:

• deployment-audited-small: up to 50 artifacts and 10 decoded MiB — $0.005 per PASS audit
• deployment-audited-medium: up to 200 artifacts and 100 decoded MiB — $0.020 per PASS audit

Failed or incomplete audits are still returned as evidence but are not charged as successful audits.

Public v0.1 deliberately stops at 100 decoded MiB and 200 artifacts. The larger tier is not offered yet because its upper-bound cost has not been independently benchmarked.

Every run also uses Apify's standard apify-actor-start event at $0.00005 per start. This enables Apify's startup-cost reduction and is separate from the PASS audit event.

Support

Use the Issues tab on this Actor's Apify page for bug reports or questions. Include the run ID, receipt finding codes, and a non-sensitive minimal manifest when possible. Never post credentials, private URLs, cookies, or tokens.