feat: enforce deployment environment preflight

scripts/deploy-production.sh

@@ -3,6 +3,16 @@ set -eu
 
 : "${RELEASE_TAG:?Set RELEASE_TAG to an immutable image tag}"
 
+production_env_file=${PRODUCTION_ENV_FILE:-.env}
+if [ ! -f "$production_env_file" ]; then
+	printf '%s\n' "Production environment file not found: $production_env_file" >&2
+	exit 1
+fi
+set -a
+. "$production_env_file"
+set +a
+./scripts/validate-production-env.sh
+
 compose_args='-f compose.production.yaml'
 export IMAGE_TAG="$RELEASE_TAG"
 

scripts/deployment-health-wait.test.sh

@@ -7,5 +7,7 @@ rollback_script=$(cat scripts/rollback-production.sh)
 printf '%s\n' "$deploy_script" | grep -F 'up -d --wait postgres redis' >/dev/null
 printf '%s\n' "$deploy_script" | grep -F 'up -d --wait api worker web' >/dev/null
 printf '%s\n' "$rollback_script" | grep -F 'up -d --wait api worker web' >/dev/null
+printf '%s\n' "$deploy_script" | grep -F './scripts/validate-production-env.sh' >/dev/null
+printf '%s\n' "$rollback_script" | grep -F './scripts/validate-production-env.sh' >/dev/null
 
 printf '%s\n' 'deployment health wait tests passed'

scripts/rollback-production.sh

@@ -3,6 +3,16 @@ set -eu
 
 : "${RELEASE_TAG:?Set RELEASE_TAG to the previously deployed immutable image tag}"
 
+production_env_file=${PRODUCTION_ENV_FILE:-.env}
+if [ ! -f "$production_env_file" ]; then
+	printf '%s\n' "Production environment file not found: $production_env_file" >&2
+	exit 1
+fi
+set -a
+. "$production_env_file"
+set +a
+./scripts/validate-production-env.sh
+
 export IMAGE_TAG="$RELEASE_TAG"
 docker compose -f compose.production.yaml up -d --wait api worker web
 docker compose -f compose.production.yaml ps