feat: run smoke checks after deploy

docs/DEPLOYMENT.md

@@ -83,13 +83,15 @@ verify the API and web health checks after a rollback.
 Run the post-deploy smoke check against the public endpoints:
 
 ```sh
-API_HEALTH_URL=http://localhost:3000/health \
 WEB_BASE_URL=http://localhost:8080 \
 ./scripts/smoke-production.sh
 ```
 
 The check performs read-only requests against API health, the web health path,
-and public search. It exits nonzero on the first failed request.
+and public search. Without `API_HEALTH_URL`, the API check runs inside the
+Compose API container, which is appropriate because the production API port is
+not exposed publicly. It exits nonzero on the first failed request. Both deploy
+and rollback scripts run this check after changing application services.
 
 ## Health Checks
 

scripts/deploy-production.sh

@@ -10,4 +10,5 @@ docker compose $compose_args build api worker web
 docker compose $compose_args up -d postgres redis
 docker compose $compose_args run --rm api npm run db:migrate
 docker compose $compose_args up -d api worker web
-docker compose $compose_args ps
+docker compose $compose_args ps
+./scripts/smoke-production.sh

scripts/rollback-production.sh

@@ -5,4 +5,5 @@ set -eu
 
 export IMAGE_TAG="$RELEASE_TAG"
 docker compose -f compose.production.yaml up -d api worker web
-docker compose -f compose.production.yaml ps
+docker compose -f compose.production.yaml ps
+./scripts/smoke-production.sh

scripts/smoke-production.sh

@@ -1,7 +1,6 @@
 #!/bin/sh
 set -eu
 
-api_url=${API_HEALTH_URL:-http://localhost:3000/health}
 web_url=${WEB_BASE_URL:-http://localhost:8080}
 search_url=${PUBLIC_SEARCH_URL:-$web_url/api/v1/public/search?query=}
 
@@ -15,6 +14,14 @@ check_url() {
   printf '%s\n' "${label} check passed"
 }
 
-check_url "$api_url" 'API'
+if [ -n "${API_HEALTH_URL:-}" ]; then
+  check_url "$API_HEALTH_URL" 'API'
+else
+  if ! docker compose -f compose.production.yaml exec -T api node -e "fetch('http://127.0.0.1:3000/health').then((response) => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"; then
+    printf '%s\n' 'API health check failed inside the Compose API service.' >&2
+    exit 1
+  fi
+  printf '%s\n' 'API check passed'
+fi
 check_url "$web_url/health" 'Web'
 check_url "$search_url" 'Public search'

scripts/smoke-production.test.sh

@@ -6,7 +6,9 @@ test_dir=$(mktemp -d)
 trap 'rm -rf "$test_dir"' EXIT
 mkdir -p "$test_dir/bin"
 printf '%s\n' '#!/bin/sh' 'exit 0' > "$test_dir/bin/curl"
+printf '%s\n' '#!/bin/sh' 'exit 0' > "$test_dir/bin/docker"
 chmod +x "$test_dir/bin/curl"
+chmod +x "$test_dir/bin/docker"
 
 PATH="$test_dir/bin:$PATH" API_HEALTH_URL=http://api.test/health WEB_BASE_URL=http://web.test \
   PUBLIC_SEARCH_URL=http://web.test/api/v1/public/search sh "$script_dir/smoke-production.sh" >/dev/null