From db8ced39b6f8a729d7fab78f40be783219f13666 Mon Sep 17 00:00:00 2001
From: 732642856 <732642856@qq.com>
Date: Sun, 19 Jul 2026 10:25:25 +0800
Subject: [PATCH] fix: expose deployed revision in health

---
 .github/workflows/deploy-production.yml  | 4 +++-
 deploy/docker-compose.server.yml         | 1 +
 frontend/tests/health-deployment.test.ts | 9 +++++++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
index 414e0e52..bab8cc83 100644
--- a/.github/workflows/deploy-production.yml
+++ b/.github/workflows/deploy-production.yml
@@ -45,6 +45,8 @@ jobs:
           printf '%s\n' '[103.117.123.53]:22000 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQJvN2Mo3Yq8e6ZIK4P2blJ5Vjj0HbknEuk7TyjhMbO' > ~/.ssh/known_hosts
 
       - name: Sync and rebuild
+        env:
+          DEPLOY_GIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
         run: |
           SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20"
           RSYNC_SSH="ssh $SSH_OPTIONS"
@@ -59,7 +61,7 @@ jobs:
             ./ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/"
 
           ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" \
-            "cd '$DEPLOY_PATH' && docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build --remove-orphans"
+            "cd '$DEPLOY_PATH' && GITHUB_SHA='$DEPLOY_GIT_SHA' docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build --remove-orphans"
 
       - name: Verify production
         run: |
diff --git a/deploy/docker-compose.server.yml b/deploy/docker-compose.server.yml
index 98b3cbf7..caa615f6 100644
--- a/deploy/docker-compose.server.yml
+++ b/deploy/docker-compose.server.yml
@@ -26,6 +26,7 @@ services:
     restart: unless-stopped
     env_file: ../.env.production
     environment:
+      GITHUB_SHA: ${GITHUB_SHA}
       PORT: 3000
       JYOTISH_API_BASE: http://api:5200
     expose:
diff --git a/frontend/tests/health-deployment.test.ts b/frontend/tests/health-deployment.test.ts
index d6add901..734f1d51 100644
--- a/frontend/tests/health-deployment.test.ts
+++ b/frontend/tests/health-deployment.test.ts
@@ -10,3 +10,12 @@ test("health endpoint exposes deployment identity for production verification",
   assert.match(source, /VERCEL_GIT_COMMIT_SHA/);
   assert.match(source, /gitCommit/);
 });
+
+test("production deployment passes the tested revision into the web runtime", () => {
+  const compose = readFileSync(new URL("../../deploy/docker-compose.server.yml", import.meta.url), "utf8");
+  const workflow = readFileSync(new URL("../../.github/workflows/deploy-production.yml", import.meta.url), "utf8");
+
+  assert.match(compose, /GITHUB_SHA: \$\{GITHUB_SHA\}/);
+  assert.match(workflow, /DEPLOY_GIT_SHA: \$\{\{ github\.event\.workflow_run\.head_sha \|\| github\.sha \}\}/);
+  assert.match(workflow, /GITHUB_SHA='\$DEPLOY_GIT_SHA'/);
+});