From b577c79124038a03167bdfb59fe287d8b494f9f3 Mon Sep 17 00:00:00 2001
From: Steve Sewell <steve@builder.io>
Date: Tue, 15 Sep 2026 04:00:55 -0700
Subject: [PATCH 1/2] chore: publish branch work in .github/workflows,
 scripts/guard-netlify-prebuilt-workflow.test.ts (2 files)

---
 .github/workflows/deploy-netlify-prebuilt.yml   | 14 +++++++++++---
 scripts/guard-netlify-prebuilt-workflow.test.ts |  5 +++++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/deploy-netlify-prebuilt.yml b/.github/workflows/deploy-netlify-prebuilt.yml
index d1f0515c103..9f505410dd9 100644
--- a/.github/workflows/deploy-netlify-prebuilt.yml
+++ b/.github/workflows/deploy-netlify-prebuilt.yml
@@ -697,8 +697,7 @@ jobs:
               if (
                 !relay?.is_secret ||
                 !relay.scopes?.includes("runtime") ||
-                typeof value?.value !== "string" ||
-                value.value.length === 0
+                !value
               ) {
                 throw new Error(
                   "AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET is not provisioned as a runtime secret for " +
@@ -706,8 +705,17 @@ jobs:
                     ".",
                 );
               }
-              console.log("Verified Google OAuth relay secret for " + context + ".");
             ' "$relay_context"
+          if ! netlify env:get AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET \
+            --site "$NETLIFY_SITE_ID" \
+            --context "$relay_context" \
+            --scope runtime \
+            --auth "$NETLIFY_AUTH_TOKEN" \
+            --json >/dev/null 2>/dev/null; then
+            echo "::error::AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET does not resolve for $relay_context."
+            exit 1
+          fi
+          echo "Verified Google OAuth relay secret for $relay_context."
 
       - name: Package the prebuilt artifact
         if: inputs.artifact_upload && inputs.migration_only != true
diff --git a/scripts/guard-netlify-prebuilt-workflow.test.ts b/scripts/guard-netlify-prebuilt-workflow.test.ts
index d26823353ad..551e5932578 100644
--- a/scripts/guard-netlify-prebuilt-workflow.test.ts
+++ b/scripts/guard-netlify-prebuilt-workflow.test.ts
@@ -120,6 +120,11 @@ describe("Google callback deploy verification guard", () => {
       /if \[\[ \"\$TARGET\" == \"beta\" && \"\$DEPLOY_MODE\" == \"production\" \]\]/,
     );
     assert.match(step, /relay_context=production/);
+    assert.match(step, /!value/);
+    assert.match(
+      step,
+      /netlify env:get AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET[\s\S]*--scope runtime[\s\S]*--json >\/dev\/null/,
+    );
     assert.match(
       step,
       /node -e[\s\S]*process\.argv\[1\][\s\S]*' \"\$relay_context\"/,

From 9bce8347cb01b473dd55c09e3cf553503873a5d7 Mon Sep 17 00:00:00 2001
From: Steve Sewell <steve@builder.io>
Date: Tue, 15 Sep 2026 04:14:46 -0700
Subject: [PATCH 2/2] chore: publish branch work in .github/workflows,
 scripts/guard-netlify-prebuilt-workflow.test.ts (2 files)

---
 .github/workflows/deploy-netlify-prebuilt.yml | 12 ++++++++++-
 .../guard-netlify-prebuilt-workflow.test.ts   | 21 ++++++++++++++++++-
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy-netlify-prebuilt.yml b/.github/workflows/deploy-netlify-prebuilt.yml
index 9f505410dd9..b8adfe136c1 100644
--- a/.github/workflows/deploy-netlify-prebuilt.yml
+++ b/.github/workflows/deploy-netlify-prebuilt.yml
@@ -711,7 +711,17 @@ jobs:
             --context "$relay_context" \
             --scope runtime \
             --auth "$NETLIFY_AUTH_TOKEN" \
-            --json >/dev/null 2>/dev/null; then
+            --json 2>/dev/null |
+            node -e '
+              const fs = require("node:fs");
+              const resolved = JSON.parse(fs.readFileSync(0, "utf8"));
+              const value = resolved.AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET;
+              if (typeof value !== "string" || value.length === 0) {
+                throw new Error(
+                  "AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET does not resolve.",
+                );
+              }
+            '; then
             echo "::error::AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET does not resolve for $relay_context."
             exit 1
           fi
diff --git a/scripts/guard-netlify-prebuilt-workflow.test.ts b/scripts/guard-netlify-prebuilt-workflow.test.ts
index 551e5932578..919a061d814 100644
--- a/scripts/guard-netlify-prebuilt-workflow.test.ts
+++ b/scripts/guard-netlify-prebuilt-workflow.test.ts
@@ -123,7 +123,26 @@ describe("Google callback deploy verification guard", () => {
     assert.match(step, /!value/);
     assert.match(
       step,
-      /netlify env:get AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET[\s\S]*--scope runtime[\s\S]*--json >\/dev\/null/,
+      /netlify env:get AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET[\s\S]*--scope runtime[\s\S]*--json 2>\/dev\/null \|[\s\S]*node -e/,
+    );
+    const resolverScript = step.match(
+      /--json 2>\/dev\/null \|\n\s*node -e '\n([\s\S]*?)\n\s*'/,
+    )?.[1];
+    assert.ok(resolverScript);
+    const runResolver = (json: string) =>
+      execFileSync(process.execPath, ["-e", resolverScript], {
+        encoding: "utf8",
+        input: json,
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+    assert.throws(
+      () => runResolver("{}"),
+      /AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET does not resolve/,
+    );
+    assert.doesNotThrow(() =>
+      runResolver(
+        '{"AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET":"test-relay-secret"}',
+      ),
     );
     assert.match(
       step,