EpicNext-Cms/src/lib/deploy-workflow-contract.test.ts

import { readFileSync } from "node:fs";
import { resolve } from "node:path";
import { describe, expect, it } from "vitest";

const liveVar = "${" + "LIVE}";
const stageVar = "${" + "STAGE}";
const userVar = "${" + "DEPLOY_USER}";
const groupVar = "${" + "DEPLOY_GROUP}";
const appVerVar = "${" + "APP_VERSION}";

function toContainLiteral(workflow: string, literal: string) {
	return workflow.indexOf(literal) >= 0;
}

describe("production deploy workflow", () => {
	const workflow = readFileSync(
		resolve(process.cwd(), ".gitea/workflows/deploy.yaml"),
		"utf8",
	);
	const deployJob = workflow.slice(workflow.indexOf("\n  deploy:"));

	it("builds in a stage worktree while preserving live .env and storage", () => {
		expect(deployJob).toContain("worktree add --detach");
		expect(deployJob).toContain("/var/tmp/atom-nexst-stage-");
		expect(toContainLiteral(deployJob, `ln -sfn "${liveVar}/.env"`)).toBe(true);
		expect(deployJob).toContain("-e storage");
		expect(deployJob).toContain("DATABASE_POOL_SIZE=");
		expect(deployJob).toContain("REDIS_URL is unset");
		expect(deployJob).not.toContain("SKIP_ENV_VALIDATION=1");
		expect(deployJob).toContain("pnpm install --frozen-lockfile");
	});

	it("reclaims ownership before git operations so www-data files can be overwritten", () => {
		const chownCmd = `sudo chown -R "${userVar}:${groupVar}"`;
		expect(toContainLiteral(workflow, chownCmd)).toBe(true);
		const reclaimAt = deployJob.indexOf(chownCmd);
		expect(
			toContainLiteral(deployJob, `git -C "${liveVar}" fetch origin --prune`),
		).toBe(true);
		const fetchAt = deployJob.indexOf(
			`git -C "${liveVar}" fetch origin --prune`,
		);
		expect(reclaimAt).toBeGreaterThan(-1);
		expect(fetchAt).toBeGreaterThan(reclaimAt);
	});

	it("avoids nuclear src wipe and verifies live src after cutover reset", () => {
		expect(deployJob).not.toContain("rm -rf src");
		expect(deployJob).not.toContain("Nuclear-replacing src/");
		expect(deployJob).toContain("no-skip-worktree");
		expect(deployJob).toContain("no-assume-unchanged");
		expect(deployJob).toContain("Verified live src/ matches HEAD");
		expect(deployJob).toContain("ls-files -v");
		expect(deployJob).not.toContain("git ls-files -z");
		expect(deployJob).toContain("pnpm typecheck");
	});

	it("swaps a built .next artifact during a short service cutover", () => {
		expect(deployJob).toContain("mv .next .next.prev");
		expect(toContainLiteral(deployJob, `mv "${stageVar}/.next" .next`)).toBe(
			true,
		);
		expect(
			toContainLiteral(deployJob, `mv "${stageVar}/node_modules" node_modules`),
		).toBe(true);
		expect(deployJob).toContain("Rolling back .next to previous artifact");
		const buildAt = deployJob.indexOf("pnpm build");
		const stopAt = deployJob.indexOf("pm2 stop next");
		const migrateAt = deployJob.indexOf("pnpm db:migrate");
		const startLabelAt = deployJob.indexOf("Starting PM2");
		const startAt = deployJob.indexOf(
			"pm2 start pnpm --name next -- start",
			startLabelAt,
		);
		expect(buildAt).toBeGreaterThan(-1);
		expect(stopAt).toBeGreaterThan(buildAt);
		expect(migrateAt).toBeGreaterThan(stopAt);
		expect(startLabelAt).toBeGreaterThan(migrateAt);
		expect(startAt).toBeGreaterThan(startLabelAt);
	});

	it("does not override onlyBuiltDependencies (uses pnpm-workspace.yaml)", () => {
		expect(workflow).not.toContain("PNPM_CONFIG_ONLY_BUILT_DEPENDENCIES");
	});

	it("runs typecheck before build in the stage", () => {
		const typecheckAt = deployJob.indexOf("pnpm typecheck");
		const buildAt = deployJob.indexOf("pnpm build");
		expect(typecheckAt).toBeGreaterThan(-1);
		expect(buildAt).toBeGreaterThan(typecheckAt);
		expect(deployJob).not.toContain("pnpm test");
	});

	it("exports APP_VERSION from git for Sentry releases", () => {
		const exportCmd = `export APP_VERSION="$(git -C "${liveVar}" rev-parse --short origin/main)"`;
		expect(toContainLiteral(workflow, exportCmd)).toBe(true);
		expect(
			toContainLiteral(
				workflow,
				`export NEXT_PUBLIC_APP_VERSION="${appVerVar}"`,
			),
		).toBe(true);
	});

	it("runs an HTTP health check before declaring deploy success", () => {
		expect(workflow).toContain("/api/health");
		expect(workflow).toContain('"database":true');
		expect(deployJob).toContain("export PORT=");
		expect(deployJob).toContain("free_tcp_port");
		const startAt = deployJob.indexOf("pm2 start pnpm --name next -- start");
		const healthAt = deployJob.indexOf("/api/health");
		const successAt = deployJob.indexOf("--- Deployed successfully ---");
		expect(startAt).toBeGreaterThan(-1);
		expect(healthAt).toBeGreaterThan(startAt);
		expect(successAt).toBeGreaterThan(healthAt);
	});
});