From 2e70c3202fda768a86abdd935e37cecade1caff9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eray=20Ayd=C4=B1n?= <eray.aydin@fingerprint.com>
Date: Thu, 24 Sep 2026 22:45:47 +0300
Subject: [PATCH] chore: update schema URL and harden sync script

Update the OpenAPI schema URL.

`curl` ran without `-f`, so an HTTP error was written to the output file and
the script still exited 0. This change fix it.

Use an `env bash` shebang and `set -euo pipefail`. Resolve paths relative to
the repository root, so the script no longer writes into whatever directory it
is invoked from. Collect the curl flags into `CURL_OPTS`, gated on `TRACE` and
`ACTIONS_STEP_DEBUG` so runs can be made verbose, and harden them: fail on
HTTP errors, retry transient failures, refuse redirects that leave https, and
bound connect and transfer time so a stalled download cannot hang CI or a
local run. Log the download.

Related-Task: INTER-2472
---
 sync.sh | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/sync.sh b/sync.sh
index 37c27f3f..f55cd233 100755
--- a/sync.sh
+++ b/sync.sh
@@ -1,3 +1,20 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -euo pipefail
 
-curl -o ./resources/fingerprint-server-api.yaml https://fingerprintjs.github.io/fingerprint-pro-server-api-openapi/schemas/fingerprint-server-api-compact.yaml
+# Resolve paths relative to the repository root, so the script can be run from
+# any working directory.
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+schemaUrl="${1:-https://fingerprintjs.github.io/openapi/schemas/fingerprint-server-api-compact.yaml}"
+
+CURL_OPTS=(-fSL --retry 3 --proto-redir '=https' --connect-timeout 10 --max-time 300)
+if [[ "${TRACE:-}" != "true" && "${ACTIONS_STEP_DEBUG:-}" != "true" ]]; then
+  CURL_OPTS+=(-s)
+fi
+
+mkdir -p ./resources
+
+echo "Downloading $schemaUrl"
+curl "${CURL_OPTS[@]}" -o ./resources/fingerprint-server-api.yaml "$schemaUrl"
+
+echo "OpenAPI schema download complete."