fix(seo): make the trailing-slash redirect relative

[MarkusNeusinger]

What I shipped wrong

#10473 removed a redirect that leaked the internal proxy URL and replaced it with a smaller version of the same defect. Verified live after the deploy:

$ curl -A Googlebot -sSI https://anyplot.ai/box-basic/ | grep -i '^http\|^location'
HTTP/2 301
location: http://anyplot.ai:8080/box-basic

Internal port, plain http. The api.anyplot.ai/seo-proxy/… leak is genuinely gone — this is not a regression to the old state — but nginx builds a permanent rewrite's Location from $scheme://$host:$server_port, and behind Cloud Run that is http on 8080.

Fix

absolute_redirect off makes the Location relative (/box-basic). The client resolves it against the URL it actually requested, which is the only value in this setup guaranteed to be correct. Hardcoding https://anyplot.ai would work today and rot the next time the scheme, host or port changes.

The guard nearly earned its keep

bot-serving-check already rejects a trailing-slash target starting with http://, so it would have failed on its next daily run — the check written in #10473 was correct, it just runs daily rather than at deploy. It now also rejects an internal port explicitly, so the next variant of this does not need the scheme to be wrong before it fails:

case "$slash_target" in
  *"/seo-proxy"*|http://*|*:8080/*)

Note on verification

nginx changes are only observable after deploy — this repo has no local loop for them, which is stated in CLAUDE.md as a known gap and is exactly how this got out. The live curl above is the verification; the guard is what makes the next one cheaper to catch.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes an SEO-related redirect bug in the anyplot-app nginx layer where the trailing-slash canonicalization was emitting an absolute Location header derived from Cloud Run’s internal scheme/port, producing http://…:8080/... for crawlers. It also tightens the scheduled bot-serving monitor to catch internal-port leaks.

Changes:

• Configure nginx to emit a relative Location for the trailing-slash redirect via absolute_redirect off.
• Add an explicit guard in bot-serving-check to reject redirects that include :8080.
• Document the incident and fix in CHANGELOG.md under Fixed.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
app/nginx.conf	Turns off absolute redirects so the trailing-slash 301 produces a relative Location instead of http://$host:8080/... behind Cloud Run.
.github/workflows/bot-serving-check.yml	Extends the redirect-leak guard to also fail on :8080 in the redirect target.
CHANGELOG.md	Adds a Fixed entry describing the internal-port redirect leak and the guard update.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

agentic/docs/project-guide.md:906

• The gcloud builds list example uses createTime.date('%H:%M'), which is not a valid gcloud --format field transform (the date() transform doesn’t accept strftime-style format strings). As written, the command is likely to fail, which undermines the goal of making deploy checks easy.

gcloud builds list --region=europe-west4 --project=anyplot --limit=10 \
  --format="table(id.slice(0,8),status,createTime.date('%H:%M'),substitutions.TRIGGER_NAME,substitutions.SHORT_SHA)"
gcloud builds describe <build-id> --region=europe-west4 --project=anyplot