name: Smoke (prod)

# Post-deploy smoke for PRODUCTION (M24-10): after a successful prod deploy, verify prod is up
# and serving using ONLY public, unauthenticated signals - health contract, testLogin:false
# (the security regression guard), the login page shell, and its asset bundles. Production
# cannot run the authenticated E2E lane: test-login is structurally forbidden there
# (config.py::_forbid_test_login_in_production), so this workflow is prod's post-deploy verdict.
# The checks live in scripts/deploy/smoke-prod.sh, unit-tested offline (stubbed curl) by
# scripts/deploy/tests/test_smoke_prod.sh.
#
# Gating posture mirrors E2E (dev): runs *after* the deploy via workflow_run, non-blocking - a
# failure surfaces as a red run + step summary (the notification), never blocks the deploy that
# already happened. No branches filter: both prod deploys are manual dispatches that act on main
# regardless of the ref they were dispatched from.
#
# ROLLBACK IS MANUAL ON PROD, by design (unlike dev's auto-rollback-to-last-e2e-green): prod
# deploys are deliberate, manual dispatches with a human already at the wheel; prod keeps no
# "last e2e-green" bookkeeping (the verdict handler scripts/deploy/e2e-promote-rollback.sh
# rejects prod outright); and an unauthenticated smoke is too shallow a signal to auto-revert
# production on. A red run's summary prints the manual path: Deploy (production) with
# `mode: rollback` for the API, the Cloudflare Pages deployment list for web. Rationale:
# docs/deployment.md, "Prod post-deploy smoke".
#
# DORMANT until the SMOKE_PROD_BASE_URL repository variable points at the prod dashboard origin
# (repo-level deliberately - a job-level `if` cannot read environment-scoped variables). While
# prod web is Cloudflare Pages, also set SMOKE_PROD_API_BASE_URL to the prod API origin: the
# Pages proxy (apps/web/functions) forwards /api/* only, and /health is not under /api. A
# single-origin prod (an ingress routing /health like dev's) needs only the one variable.
#
# Deliberately credential-free: no secrets, no `environment:` binding - everything probed is
# public surface, so a prod environment protection rule can never delay or gate the check.

on:
  workflow_run:
    workflows: ["Deploy (production)", "Deploy Web (production)"]
    types: [completed]
  workflow_dispatch:

concurrency:
  group: smoke-prod
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  smoke:
    # Only after a successful prod deploy, and only once a smoke target URL is configured.
    if: >-
      ${{ vars.SMOKE_PROD_BASE_URL != '' &&
          (github.event_name == 'workflow_dispatch' ||
           github.event.workflow_run.conclusion == 'success') }}
    runs-on: bloom-arc
    steps:
      # The checks version with the deployed code, which always comes from main (both prod
      # deploy workflows pin ref: main).
      - uses: actions/checkout@v4
        with:
          ref: main

      - name: Run unauthenticated smoke checks against prod
        env:
          SMOKE_BASE_URL: ${{ vars.SMOKE_PROD_BASE_URL }}
          SMOKE_API_BASE_URL: ${{ vars.SMOKE_PROD_API_BASE_URL }}
        run: bash scripts/deploy/smoke-prod.sh