CI Deploy Verify

CI & Deploy Verify

End-to-end health check for wcygan.net. Three phases, always run in order — each phase short-circuits diagnosis for the next.

Phase 1 — GitHub Actions CI on main

gh run list --branch main --limit 3

Look at the top row:

• completed + success → CI green, move to phase 2.
• in_progress / queued → wait for it. Options:
  • Block: gh run watch <id> --exit-status
  • Glance: rerun gh run list --branch main --limit 1
• completed + failure → stop. Fix CI first.
  • Get the failed step: gh run view <id> --log-failed | tail -80
  • Rerun after fix: gh run rerun <id> (same commit) or push a new commit.

The workflow is .github/workflows/ci.yml — build → typecheck → test.

Phase 2 — Cloudflare deploy

deno task --eval "wrangler deployments list" | tail -12

Each deploy entry has Created: timestamp and a version ID. The most recent one should be newer than your push time. If not:

• Cloudflare Workers Builds may still be running — check the Cloudflare dashboard (Workers & Pages → wcygan-net → Deployments).
• If multiple pushes happened in quick succession, only the latest produces a live deploy (Cloudflare debounces).

For a specific version:

deno task --eval "wrangler deployments list --name wcygan-net"
deno task --eval "wrangler versions list --name wcygan-net" | tail -10

Phase 3 — Regression suite against production

./scripts/verify-prod.sh

Exit 0 = all checks pass. Exit 1 = at least one check failed, with per-check diagnosis printed.

Covers:

1. Core routes return 2xx/3xx: /, /about, /posts, /really-good-software.
2. Static-asset dot-rejection guard: /rss.xml, /will_cygan_resume.pdf, /favicon.ico → 200. Validates that src/lib/routing/static-asset-guard.ts still works in prod.
3. Removed routes stay 404: /feed, /mermaid-examples. Guarantees the audit cleanup didn't regress.
4. RSS content: /rss.xml is well-formed XML with <rss> root and <atom:link> self-reference.
5. Build fingerprint: homepage HTML contains __TSR_ (TanStack build) and no __sveltekit (stale Worker).

Run against a preview or local build:

./scripts/verify-prod.sh --base http://localhost:3000
./scripts/verify-prod.sh --base https://<branch>.wcygan-net.pages.dev

Verbose mode prints the URL + status code on failure:

./scripts/verify-prod.sh --verbose

One-shot end-to-end

gh run list --branch main --limit 1 \
  && deno task --eval "wrangler deployments list" | tail -6 \
  && ./scripts/verify-prod.sh

All three exit cleanly → deploy is healthy.

Common failure patterns

Related skills

• verify-live-stack — deeper fingerprint/cache diagnostics when Phase 3 fails (e.g., distinguishing stale CDN vs failed deploy).
• cloudflare-static-deploy — the deploy pipeline this skill verifies the output of.
• github-actions-troubleshooter — when Phase 1 fails and you need to fix the workflow itself.

Adding new regression checks

Edit scripts/verify-prod.sh — it's plain bash using curl + grep, no deps beyond what ships on macOS / Ubuntu. Use the existing helpers:

• status_is URL CODE — exact status match
• status_in URL CODE [CODE ...] — status is one of
• body_contains URL PATTERN — response body matches grep pattern

Each check wraps with check "name" <helper> <args>. Failures are counted and named in the summary. Keep checks independent — no shared state between them.