Merge pull request #3 from jesse-ux/codex/fix-deployment-identity

fix: expose deployed revision in health

.github/workflows/deploy-production.yml

@@ -45,6 +45,8 @@ jobs:
           printf '%s\n' '[103.117.123.53]:22000 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQJvN2Mo3Yq8e6ZIK4P2blJ5Vjj0HbknEuk7TyjhMbO' > ~/.ssh/known_hosts
 
       - name: Sync and rebuild
+        env:
+          DEPLOY_GIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
         run: |
           SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20"
           RSYNC_SSH="ssh $SSH_OPTIONS"
@@ -59,7 +61,7 @@ jobs:
             ./ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/"
 
           ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" \
-            "cd '$DEPLOY_PATH' && docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build --remove-orphans"
+            "cd '$DEPLOY_PATH' && GITHUB_SHA='$DEPLOY_GIT_SHA' docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build --remove-orphans"
 
       - name: Verify production
         run: |

deploy/docker-compose.server.yml

@@ -26,6 +26,7 @@ services:
     restart: unless-stopped
     env_file: ../.env.production
     environment:
+      GITHUB_SHA: ${GITHUB_SHA}
       PORT: 3000
       JYOTISH_API_BASE: http://api:5200
     expose:

frontend/tests/health-deployment.test.ts

@@ -10,3 +10,12 @@ test("health endpoint exposes deployment identity for production verification",
   assert.match(source, /VERCEL_GIT_COMMIT_SHA/);
   assert.match(source, /gitCommit/);
 });
+
+test("production deployment passes the tested revision into the web runtime", () => {
+  const compose = readFileSync(new URL("../../deploy/docker-compose.server.yml", import.meta.url), "utf8");
+  const workflow = readFileSync(new URL("../../.github/workflows/deploy-production.yml", import.meta.url), "utf8");
+
+  assert.match(compose, /GITHUB_SHA: \$\{GITHUB_SHA\}/);
+  assert.match(workflow, /DEPLOY_GIT_SHA: \$\{\{ github\.event\.workflow_run\.head_sha \|\| github\.sha \}\}/);
+  assert.match(workflow, /GITHUB_SHA='\$DEPLOY_GIT_SHA'/);
+});