Marc-André BombeckandClaude Opus 4.7 ffa4aac974 feat(ci): post-publish verify workflow ...

Informational reachability gate that runs after `Build & Publish
Docker Image` finishes a `main` (or tag) build. Triggered via
`workflow_run` so it always observes the actual completion state of
the build, then:

  1. pulls `ghcr.io/${repo}:${tag}` (proves the manifest finished
     publishing — the v1.4.14 main run "succeeded" from a wall-clock
     POV but the image had to be retagged on the deploy host because
     main's manifest never finished pushing; this catches that)
  2. boots the container against an ephemeral Postgres service
  3. probes `/api/version` (smoke for the build SHA + version slug)
  4. probes `/api/health` (smoke for the runtime DB/worker probes)

Every probe runs `continue-on-error: true` — this workflow is
informational, not a deploy gate. A transient registry blip should
surface as a yellow run, not block subsequent builds.

Also wired up `workflow_dispatch` with an `image_tag` input so we
can spot-verify any tag (`v1.4.15`, `v1.4.14`, etc.) on demand
without re-publishing.

Marc-status: filed as proof-of-concept for v1.4.15 phase-C2's
auto-deploy work — Coolify webhook listener can build on top of
the same boot harness.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-09 20:48:37 +02:00

..

workflows

feat(ci): post-publish verify workflow

2026-05-09 20:48:37 +02:00

dependabot.yml

Initial release v1.0.0

2026-03-10 20:14:33 +01:00