feat: enforce deployment environment preflight

docs/DEPLOYMENT.md

@@ -35,8 +35,9 @@ provider's HTTPS endpoint and provide its token through
 `PRICING_HTTP_PROVIDER_TOKEN` when required. Production startup rejects the
 fixture provider, missing endpoints, and non-HTTPS endpoints.
 
-Load the deployment environment into the shell and run the side-effect-free
-preflight before deploying:
+The deploy and rollback scripts load `PRODUCTION_ENV_FILE` (default `.env`)
+and run the side-effect-free preflight before touching Compose. Run them from
+the repository root:
 
 ```sh
 set -a
@@ -45,6 +46,9 @@ set +a
 ./scripts/validate-production-env.sh
 ```
 
+To use a separate production file, set `PRODUCTION_ENV_FILE=/secure/path/.env`
+when invoking the deploy or rollback script.
+
 Start the stack and apply migrations with:
 
 ```sh

scripts/deploy-production.sh

@@ -3,6 +3,16 @@ set -eu
 
 : "${RELEASE_TAG:?Set RELEASE_TAG to an immutable image tag}"
 
+production_env_file=${PRODUCTION_ENV_FILE:-.env}
+if [ ! -f "$production_env_file" ]; then
+	printf '%s\n' "Production environment file not found: $production_env_file" >&2
+	exit 1
+fi
+set -a
+. "$production_env_file"
+set +a
+./scripts/validate-production-env.sh
+
 compose_args='-f compose.production.yaml'
 export IMAGE_TAG="$RELEASE_TAG"
 

scripts/deployment-health-wait.test.sh

@@ -7,5 +7,7 @@ rollback_script=$(cat scripts/rollback-production.sh)
 printf '%s\n' "$deploy_script" | grep -F 'up -d --wait postgres redis' >/dev/null
 printf '%s\n' "$deploy_script" | grep -F 'up -d --wait api worker web' >/dev/null
 printf '%s\n' "$rollback_script" | grep -F 'up -d --wait api worker web' >/dev/null
+printf '%s\n' "$deploy_script" | grep -F './scripts/validate-production-env.sh' >/dev/null
+printf '%s\n' "$rollback_script" | grep -F './scripts/validate-production-env.sh' >/dev/null
 
 printf '%s\n' 'deployment health wait tests passed'

scripts/rollback-production.sh

@@ -3,6 +3,16 @@ set -eu
 
 : "${RELEASE_TAG:?Set RELEASE_TAG to the previously deployed immutable image tag}"
 
+production_env_file=${PRODUCTION_ENV_FILE:-.env}
+if [ ! -f "$production_env_file" ]; then
+	printf '%s\n' "Production environment file not found: $production_env_file" >&2
+	exit 1
+fi
+set -a
+. "$production_env_file"
+set +a
+./scripts/validate-production-env.sh
+
 export IMAGE_TAG="$RELEASE_TAG"
 docker compose -f compose.production.yaml up -d --wait api worker web
 docker compose -f compose.production.yaml ps