fix(ci): verify live deployment readiness before release checks

Author: Coding-Professional

.github/workflows/ci.yml

@@ -41,6 +41,9 @@ jobs:
       - name: Unit tests
         run: npm test
 
+      - name: Deployment gate tests
+        run: node --test scripts/*.test.mjs
+
       - name: Production build
         run: npm run build
 

public/fonts/OFL.txt

@@ -18,7 +18,7 @@ with others.
 
 The OFL allows the licensed fonts to be used, studied, modified and
 redistributed freely as long as they are not sold by themselves. The
-fonts, including any derivative works, can be bundled, embedded, 
+fonts, including any derivative works, can be bundled, embedded,
 redistributed and/or sold with any software provided that any reserved
 names are not used by derivative works. The fonts and derivatives,
 however, cannot be released under any other type of license. The

scripts/deploy-vercel.mjs

@@ -4,6 +4,7 @@ import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { waitForDeployment } from "./deployment-status.mjs";
 
 const root = path.resolve(import.meta.dirname, "..");
 const localStaging = process.argv.includes("--local-staging");
@@ -56,6 +57,28 @@ function authentication(tokenKey) {
   return requireValue(tokenKey);
 }
 
+async function confirmReady(result, cwd, project, token, label) {
+  return waitForDeployment(result.deployment?.id, {
+    label,
+    read: async id => {
+      if (!token) {
+        const inspected = vercel(["inspect", id, "--json"], cwd, project);
+        return inspected.deployment ?? inspected;
+      }
+      const endpoint = new URL(`https://api.vercel.com/v13/deployments/${id}`);
+      endpoint.searchParams.set("teamId", requireValue("VERCEL_ORG_ID"));
+      const response = await fetch(endpoint, {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(30_000),
+      });
+      if (!response.ok) throw new Error(`${label} status lookup failed (${response.status}).`);
+      const deployment = await response.json();
+      if (deployment.projectId !== project) throw new Error(`${label} deployment belongs to a different project.`);
+      return { id: deployment.id, readyState: deployment.readyState };
+    },
+  });
+}
+
 function deploySource() {
   const result = spawnSync("git", ["ls-files", "-z"], { cwd: root, encoding: "utf8", windowsHide: true });
   if (result.status !== 0) throw new Error("Cannot enumerate tracked deployment source.");
@@ -103,8 +126,9 @@ async function main() {
   const frontendSource = deploySource();
   fs.copyFileSync(path.join(backendSource, "vercel.backend.json"), path.join(backendSource, "vercel.json"));
   const deployArgs = ["deploy", "--prod", "--yes", "--json", "--meta", `sourceCommit=${sha}`, "--meta", `sourceBranch=${branch}`];
-  const backend = vercel([...deployArgs, "--project", backendProject], backendSource, backendProject, authentication("VERCEL_BACKEND_TOKEN"));
-  if (backend.status === "error" || backend.deployment?.readyState !== "READY") throw new Error("Backend deployment did not become ready.");
+  const backendToken = authentication("VERCEL_BACKEND_TOKEN");
+  const backend = vercel([...deployArgs, "--project", backendProject], backendSource, backendProject, backendToken);
+  await confirmReady(backend, backendSource, backendProject, backendToken, "Backend");
   await check(`${backendOrigin}/api/platform/health`, async r => r.ok && (await r.json()).status === "ok");
   await check(`${backendOrigin}/api/platform/auth/session`, async r => {
     if (!r.ok) return false;
@@ -113,8 +137,9 @@ async function main() {
   });
   console.log("Backend is ready; database-backed session check passed.");
 
-  const frontend = vercel([...deployArgs, "--project", frontendProject], frontendSource, frontendProject, authentication("VERCEL_FRONTEND_TOKEN"));
-  if (frontend.status === "error" || frontend.deployment?.readyState !== "READY") throw new Error("Frontend deployment did not become ready.");
+  const frontendToken = authentication("VERCEL_FRONTEND_TOKEN");
+  const frontend = vercel([...deployArgs, "--project", frontendProject], frontendSource, frontendProject, frontendToken);
+  await confirmReady(frontend, frontendSource, frontendProject, frontendToken, "Frontend");
   await check(publicOrigin, async r => r.ok && (branch === "main" || r.headers.get("x-robots-tag")?.includes("noindex")));
   console.log(`Frontend is ready: ${publicOrigin}`);
   const summary = `### ${branch === "main" ? "Production" : "Staging"} deployment\n\nCommit: \`${sha}\`\n\n- Frontend: ${publicOrigin}\n- Backend: ${backendOrigin}\n- Health and database-backed session checks passed.\n`;

scripts/deployment-status.mjs

@@ -0,0 +1,20 @@
+/** Confirm provider state instead of trusting the CLI's deployment snapshot. */
+export async function waitForDeployment(id, {
+  read,
+  label,
+  maxAttempts = 60,
+  intervalMs = 5000,
+  sleep = ms => new Promise(resolve => setTimeout(resolve, ms)),
+}) {
+  if (!/^dpl_[a-zA-Z0-9]+$/.test(id ?? "")) throw new Error(`${label} deployment ID is missing or invalid.`);
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    const deployment = await read(id);
+    if (deployment.id !== id) throw new Error(`${label} status returned a different deployment.`);
+    if (deployment.readyState === "READY") return deployment;
+    if (["ERROR", "CANCELED", "CANCELLED"].includes(deployment.readyState)) {
+      throw new Error(`${label} deployment failed (${deployment.readyState}).`);
+    }
+    if (attempt + 1 < maxAttempts) await sleep(intervalMs);
+  }
+  throw new Error(`${label} deployment did not become ready before the timeout.`);
+}

scripts/deployment-status.test.mjs

@@ -0,0 +1,38 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { waitForDeployment } from "./deployment-status.mjs";
+
+const id = "dpl_test123";
+const options = { label: "Backend", intervalMs: 0, maxAttempts: 3 };
+
+test("queued and building deployments are checked until the provider reports ready", async () => {
+  const states = ["QUEUED", "BUILDING", "READY"];
+  const seen = [];
+  const result = await waitForDeployment(id, { ...options, read: async requested => {
+    seen.push(requested);
+    return { id, readyState: states.shift() };
+  } });
+  assert.equal(result.readyState, "READY");
+  assert.deepEqual(seen, [id, id, id]);
+});
+
+test("failed or canceled builds cannot pass the readiness gate", async () => {
+  for (const readyState of ["ERROR", "CANCELED", "CANCELLED"]) {
+    await assert.rejects(waitForDeployment(id, { ...options, read: async () => ({ id, readyState }) }), /deployment failed/);
+  }
+});
+
+test("a deployment that stays queued fails after bounded polling", async () => {
+  let reads = 0;
+  await assert.rejects(waitForDeployment(id, { ...options, read: async () => {
+    reads++;
+    return { id, readyState: "QUEUED" };
+  } }), /timeout/);
+  assert.equal(reads, options.maxAttempts);
+});
+
+test("missing IDs, mismatched records and unavailable status lookups fail closed", async () => {
+  await assert.rejects(waitForDeployment(undefined, { ...options, read: async () => assert.fail("unexpected lookup") }), /ID is missing/);
+  await assert.rejects(waitForDeployment(id, { ...options, read: async () => ({ id: "dpl_other", readyState: "READY" }) }), /different deployment/);
+  await assert.rejects(waitForDeployment(id, { ...options, read: async () => { throw new Error("Status unavailable"); } }), /Status unavailable/);
+});