From 957ebae05ffdf1a3861d50c10f1084133d722a9b Mon Sep 17 00:00:00 2001
From: cesnimda <connor.babbington@cesnimda.co.uk>
Date: Wed, 1 Jul 2026 15:54:38 +0200
Subject: [PATCH] ci(staging): add post-deploy health gate

'docker compose up -d' returns once containers start, so a container that
crashes on boot (as the api did on the DB password mismatch) still reported
success. Poll the frontend and api endpoints after deploy and fail the job,
dumping api logs, if either isn't serving within ~60s. ASCII only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .gitea/workflows/deploy-staging.yml | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/deploy-staging.yml b/.gitea/workflows/deploy-staging.yml
index 27718a3..733d664 100644
--- a/.gitea/workflows/deploy-staging.yml
+++ b/.gitea/workflows/deploy-staging.yml
@@ -43,6 +43,28 @@ jobs:
             up -d --build
           docker compose -p inboxintel-staging ps
 
-      - name: Staging endpoints
+      - name: Verify staging health
         shell: powershell
-        run: Write-Host "Staging up - Frontend http://localhost:18081  API http://localhost:18080/swagger"
+        # 'up -d' returns as soon as containers START, so a container that crashes
+        # on boot (e.g. bad DB password) would still report success. Poll the actual
+        # endpoints and fail the job if either isn't serving, dumping api logs so the
+        # cause is visible in the run. ASCII only (Windows PowerShell reads .ps1 as ANSI).
+        run: |
+          $ok = $false
+          foreach ($i in 1..20) {
+            Start-Sleep -Seconds 3
+            try { Invoke-WebRequest "http://localhost:18081/" -UseBasicParsing -TimeoutSec 5 | Out-Null; $fe = 200 }
+            catch { $fe = 0 }
+            # A 401 from the api means it is serving (auth enforced); Invoke-WebRequest
+            # throws on non-2xx, so read the status code off the exception.
+            try { Invoke-WebRequest "http://localhost:18080/api/v1/auth/me" -UseBasicParsing -TimeoutSec 5 | Out-Null; $api = 200 }
+            catch { $api = $_.Exception.Response.StatusCode.value__; if (-not $api) { $api = 0 } }
+            Write-Host "attempt $i - frontend=$fe api=$api"
+            if ($fe -eq 200 -and $api -gt 0) { $ok = $true; break }
+          }
+          if (-not $ok) {
+            Write-Host "Staging health check FAILED. Last 40 api log lines:"
+            docker logs inboxintel-staging-api-1 --tail 40
+            exit 1
+          }
+          Write-Host "Staging healthy - Frontend http://localhost:18081  API http://localhost:18080"