0pt/.gitea/workflows/prod-smoke.yml

name: Production smoke (0pt.app)

# Automated end-to-end delivery verification. Every 30 minutes (and on demand)
# this checks that the live service is actually ready and that the running
# container is the commit that main points at — so a green deploy is never
# confused with a healthy, current service.
on:
  workflow_dispatch:
  schedule:
    - cron: "*/30 * * * *"

concurrency:
  group: prod-smoke
  cancel-in-progress: true

jobs:
  smoke:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Readiness (retry on a fresh deploy)
        run: |
          set -eu
          for attempt in 1 2 3 4 5 6; do
            body="$(curl -fsS --max-time 15 https://0pt.app/api/ready || true)"
            echo "attempt $attempt: ${body:-<no response>}"
            if printf '%s' "$body" | grep -q '"ready":true'; then
              exit 0
            fi
            sleep 20
          done
          echo "::error::0pt.app/api/ready never reported ready:true"
          exit 1

      - name: Health envelope
        run: |
          set -eu
          body="$(curl -fsS --max-time 15 https://0pt.app/api/health)"
          echo "$body"
          printf '%s' "$body" | grep -q '"db":"ok"' || { echo "::error::database is not ok"; exit 1; }
          printf '%s' "$body" | grep -q '"stripe":"ok"' || { echo "::error::stripe is not ok"; exit 1; }

      - name: Deployed commit equals main
        env:
          SIAX_CI_TOKEN: ${{ secrets.SIAX_CI_TOKEN }}
        run: |
          set -eu
          version="$(curl -fsS --max-time 15 https://0pt.app/api/version)"
          echo "$version"
          running="$(printf '%s' "$version" | sed -n 's/.*"commit":"\([0-9a-f]*\)".*/\1/p')"
          [ -n "$running" ] || { echo "::error::/api/version returned no commit"; exit 1; }
          if [ -z "${SIAX_CI_TOKEN:-}" ]; then
            echo "::warning::SIAX_CI_TOKEN is not set — cannot compare with main; commit $running is live"
            exit 0
          fi
          expected="$(curl -fsS --max-time 15 \
            -H "Authorization: token ${SIAX_CI_TOKEN}" \
            "https://git.siax.io/api/v1/repos/admin/0pt/commits?limit=1" \
            | python3 -c 'import sys,json; print(json.load(sys.stdin)[0]["sha"])')"
          echo "running=$running expected(main)=$expected"
          [ -n "$expected" ] || { echo "::error::could not read main SHA from Gitea"; exit 1; }
          [ "$running" = "$expected" ] || {
            echo "::error::production is $running but main is $expected — deploy did not land"
            exit 1
          }

      - name: Document pipeline surface responds (auth required, never 404/5xx)
        run: |
          set -eu
          for path in /api/0pt/documents/upload /api/0pt/documents/structure /api/0pt/documents/models /api/0pt/credits/balance; do
            code="$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 -X POST "https://0pt.app${path}")"
            echo "$path -> $code"
            case "$code" in
              401|405) ;; # unauthenticated or method guard: the route exists
              *) echo "::error::$path returned $code (expected 401/405)"; exit 1 ;;
            esac
          done