Another report: https://www.mediawiki.org/wiki/Talk:Product_Safety_and_Integrity/Anti-abuse_signals/hCaptcha#hCaptcha_does_not_show

Thanks for filing the task, and sorry for the issues being encountered here. The problem being reported is because we are using 100% passive mode for ConfirmEdit's "edit" trigger, with an "always challenge" mode set for the "addurl" trigger. The "addurl" trigger has always functioned after a page reload. We updated the AbuseFilter "showcaptcha" trigger (which has a similar flow of happening after a page reload) to tell the user that they need to resubmit the form, but we missed doing that for "addurl" when in 100% passive mode

The problem will go away tomorrow (Dec 8) when we switch enwiki to use 99.9% passive mode. At that point, adding a URL will be treated like any other edit, with a challenge only being shown if hCaptcha finds the edit session to be suspicious of bot activity. The challenge would appear immediately on pressing "Publish changes", and not after a page reload.

I've also filed T411963: hCaptcha: Automatically resubmit "publish changes" when AbuseFilter's "showcaptcha" trigger is invoked to make the experience in the AbuseFilter "showcaptcha" path more intuitive.

Just flagging that we are tracking this bug - thanks for documenting it here. Our initial team discussion about it suggests this is an unintended byproduct of running enwiki in 100% passive mode, and that it will be addressed when we move to 99.9% passive mode (which is scheduled for tomorrow morning, Monday).

(EDIT: While I had the page open to write this, @kostajh posted more detail above.)

Thanks for updates and that there is a quick resolution. Should this be delayed we can insert some help text in to the error message - instructing end users to resubmit the publish as a workaround.

I did a test, the edit just went though - were you able to verify it actually works if the automatic hcaptcha failed?

In T411927#11439859, @Xaosflux wrote:

I did a test, the edit just went though - were you able to verify it actually works if the automatic hcaptcha failed?

Yes. I have a scripted environment to check if the hCaptcha challenge is triggered

const { remote } = require('webdriverio');

async function testCaptchaProtection() {
    const browser = await remote({
        capabilities: {
            browserName: 'chrome',
            'goog:chromeOptions': {
                args: ['--disable-blink-features=AutomationControlled', '--ignore-certificate-errors']
            }
        }
    });

    try {
        await browser.url('https://en.wikipedia.org/wiki/Test?action=edit'); // navigate to whatever page you want after the browser loads
        
        await browser.waitUntil(async () => {
            const title = await browser.getTitle();
            return title.length > 0;
        }, { timeout: 3000000 });
        await browser.pause( 3000000 );
    } catch (error) {
        console.error('Error during test:', error.message);
    } finally {
        await browser.deleteSession();
    }
}

testCaptchaProtection();

with a package.json of:

{
  "dependencies": {
    "webdriverio": "^9.19.2"
  }
}