From 0008af9f2c9d6a3e4825883e3f52d5aab2c53295 Mon Sep 17 00:00:00 2001
From: FragginWagon <greg.r.jacobs@gmail.com>
Date: Thu, 10 Sep 2026 02:32:43 -0400
Subject: [PATCH] feat: enforce deployment environment preflight

---
 docs/DEPLOYMENT.md                     |  8 ++++++--
 scripts/deploy-production.sh           | 10 ++++++++++
 scripts/deployment-health-wait.test.sh |  2 ++
 scripts/rollback-production.sh         | 10 ++++++++++
 4 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md
index 84c7796..423a41d 100644
--- a/docs/DEPLOYMENT.md
+++ b/docs/DEPLOYMENT.md
@@ -35,8 +35,9 @@ provider's HTTPS endpoint and provide its token through
 `PRICING_HTTP_PROVIDER_TOKEN` when required. Production startup rejects the
 fixture provider, missing endpoints, and non-HTTPS endpoints.
 
-Load the deployment environment into the shell and run the side-effect-free
-preflight before deploying:
+The deploy and rollback scripts load `PRODUCTION_ENV_FILE` (default `.env`)
+and run the side-effect-free preflight before touching Compose. Run them from
+the repository root:
 
 ```sh
 set -a
@@ -45,6 +46,9 @@ set +a
 ./scripts/validate-production-env.sh
 ```
 
+To use a separate production file, set `PRODUCTION_ENV_FILE=/secure/path/.env`
+when invoking the deploy or rollback script.
+
 Start the stack and apply migrations with:
 
 ```sh
diff --git a/scripts/deploy-production.sh b/scripts/deploy-production.sh
index 79d7cbf..691d52d 100755
--- a/scripts/deploy-production.sh
+++ b/scripts/deploy-production.sh
@@ -3,6 +3,16 @@ set -eu
 
 : "${RELEASE_TAG:?Set RELEASE_TAG to an immutable image tag}"
 
+production_env_file=${PRODUCTION_ENV_FILE:-.env}
+if [ ! -f "$production_env_file" ]; then
+	printf '%s\n' "Production environment file not found: $production_env_file" >&2
+	exit 1
+fi
+set -a
+. "$production_env_file"
+set +a
+./scripts/validate-production-env.sh
+
 compose_args='-f compose.production.yaml'
 export IMAGE_TAG="$RELEASE_TAG"
 
diff --git a/scripts/deployment-health-wait.test.sh b/scripts/deployment-health-wait.test.sh
index 5c81837..7da613b 100644
--- a/scripts/deployment-health-wait.test.sh
+++ b/scripts/deployment-health-wait.test.sh
@@ -7,5 +7,7 @@ rollback_script=$(cat scripts/rollback-production.sh)
 printf '%s\n' "$deploy_script" | grep -F 'up -d --wait postgres redis' >/dev/null
 printf '%s\n' "$deploy_script" | grep -F 'up -d --wait api worker web' >/dev/null
 printf '%s\n' "$rollback_script" | grep -F 'up -d --wait api worker web' >/dev/null
+printf '%s\n' "$deploy_script" | grep -F './scripts/validate-production-env.sh' >/dev/null
+printf '%s\n' "$rollback_script" | grep -F './scripts/validate-production-env.sh' >/dev/null
 
 printf '%s\n' 'deployment health wait tests passed'
\ No newline at end of file
diff --git a/scripts/rollback-production.sh b/scripts/rollback-production.sh
index 3dcfc02..909b3ef 100755
--- a/scripts/rollback-production.sh
+++ b/scripts/rollback-production.sh
@@ -3,6 +3,16 @@ set -eu
 
 : "${RELEASE_TAG:?Set RELEASE_TAG to the previously deployed immutable image tag}"
 
+production_env_file=${PRODUCTION_ENV_FILE:-.env}
+if [ ! -f "$production_env_file" ]; then
+	printf '%s\n' "Production environment file not found: $production_env_file" >&2
+	exit 1
+fi
+set -a
+. "$production_env_file"
+set +a
+./scripts/validate-production-env.sh
+
 export IMAGE_TAG="$RELEASE_TAG"
 docker compose -f compose.production.yaml up -d --wait api worker web
 docker compose -f compose.production.yaml ps