From 9cbc7de3404138e8c39c591277bb808372b4c3e9 Mon Sep 17 00:00:00 2001
From: tangsongdayo <tangsong@mail.fishking.studio>
Date: Sun, 19 Jul 2026 13:05:49 +0800
Subject: [PATCH] test: add post-deploy smoke checks

---
 CHANGELOG.md          |  1 +
 README.md             |  6 ++++++
 docs/RELEASING.md     |  2 +-
 scripts/smoke-test.sh | 19 +++++++++++++++++++
 4 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 scripts/smoke-test.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1fff681..3088a1b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@
 - Added persistent alert delivery with HTTPS validation, exponential-backoff retries, and Prometheus delivery-state metrics.
 - Added verified backup reports plus optional age-encrypted rclone offsite copies.
 - Added production dependency auditing, reproducible SPDX SBOM generation, and a documented release/upgrade/signing path.
+- Added a repeatable post-deploy HTTP smoke test for health, homepage, RSS, and metrics endpoints.
 
 ### Fixed
 
diff --git a/README.md b/README.md
index 3a05a52..288b29d 100644
--- a/README.md
+++ b/README.md
@@ -46,6 +46,12 @@ docker compose ps
 docker compose logs -f web worker
 ```
 
+部署後可執行公開端點冒煙測試（若 metrics 有設 token，先匯出同一個 `METRICS_TOKEN`）：
+
+```bash
+./scripts/smoke-test.sh https://你的網域
+```
+
 ## 環境變數
 
 以 `.env.example` 為範本。正式環境請更換所有 secret，且不要將 `.env` 加入 Git。
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index 14a37ce..0139330 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -3,7 +3,7 @@
 ## 每次發布前
 
 1. 確認 `CHANGELOG.md` 的 Unreleased 內容與目標版本一致。
-2. 在本機執行 `npm test`、`npx tsc --noEmit`、`npm run build` 與 `./scripts/backup.sh`。
+2. 在本機執行 `npm test`、`npx tsc --noEmit`、`npm run build` 與 `./scripts/backup.sh`；部署後執行 `./scripts/smoke-test.sh https://你的網域`。
 3. 提交並推送 `main`，確認 Gitea Actions 的 verify workflow 成功；它會執行 production dependency audit、測試、Docker build，並產生 SPDX SBOM artifact。
 4. 建立 annotated tag，例如：`git tag -a v0.8.0 -m "Mebbling v0.8.0"`，再執行 `git push origin v0.8.0`。
 5. 在 Gitea 的 Releases 以同一個 tag 建立 release；若版本尚供測試，勾選 Pre-release。
diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
new file mode 100644
index 0000000..2c9c3a2
--- /dev/null
+++ b/scripts/smoke-test.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+base_url="${1:-http://localhost:8088}"
+base_url="${base_url%/}"
+get() { curl --fail --silent --show-error "$@"; }
+
+live="$(get "$base_url/api/health?probe=live")"
+ready="$(get "$base_url/api/health?probe=ready")"
+home="$(get "$base_url/")"
+rss_headers="$(get -I "$base_url/rss.xml")"
+if [[ -n "${METRICS_TOKEN:-}" ]]; then metrics="$(get -H "Authorization: Bearer $METRICS_TOKEN" "$base_url/api/metrics")"; else metrics="$(get "$base_url/api/metrics")"; fi
+
+[[ "$live" == *'"status":"live"'* ]] || { echo "Liveness probe did not return live" >&2; exit 1; }
+[[ "$ready" == *'"status":"ready"'* && "$ready" == *'"database":"ok"'* ]] || { echo "Readiness probe did not confirm database" >&2; exit 1; }
+[[ "$home" == *'<title>Mebbling</title>'* ]] || { echo "Home page title missing" >&2; exit 1; }
+[[ "${rss_headers,,}" == *'content-type: application/rss+xml'* ]] || { echo "RSS content type missing" >&2; exit 1; }
+[[ "$metrics" == *'mebbling_sources_enabled'* ]] || { echo "Metrics response is incomplete" >&2; exit 1; }
+printf 'Smoke test passed: %s\n' "$base_url"