When user attempts to add an Approval Path action in Jira Automation, it gets stuck on connecting a user. Clicking ‘Next’ after a user was picked does nothing.

Claude analysis:

It’s a Content Security Policy block. The Automation action’s settings page tries to load its script and stylesheet from the QA backend, Forge refuses both, so nothing renders and the panel stays at zero height.

Loading the stylesheet 'https://ap.app.qa1.pl/forge/index.css' violates the followingContent Security Policy directive: "style-src 'self' ak-test-1.atlassian.nethttps://forge.cdn.prod.atlassian-dev.net https://tdp-os.services.atlassian.com/... 'unsafe-inline'".The action has been blocked. Loading the script 'https://ap.app.qa1.pl/forge/index.js' violates the followingContent Security Policy directive: "script-src 'self' https://forge.cdn.prod.atlassian-dev.nethttps://tdp-os.services.atlassian.com/fos/app/download/ ...". The action has been blocked.

• ap.app.qa1.pl is missing: it isn’t allowed in script-src or style-src.

• Other errors: an “Iframe bridge … invalid origin” error also appeared, but that comes from opening the page outside Jira, so ignore it. The Cannot use 'import.meta' outside a module errors on the Jira page itself couldn’t be traced to a source.

The app’s Forge Automation action, resource f7e7b6fa-…, can’t load its UI. Its scripts and styles come from https://ap.app.qa1.pl/forge/, which the Forge manifest’s content permissions don’t allow (permissions.external.scripts / styles). Either the manifest needs that host allowed, or the action’s assets need bundling into the Forge resource.