fix(ci): smoke test boots the way production boots, and can fail #10

Merged

john merged 1 commit from fix/smoke-test-can-fail into dev

2026-07-26 23:34:30 +00:00

john commented

2026-07-26 23:11:26 +00:00

Owner

The check could not fail

docker run --rm -d --name haskos-finance-smoke \
  -e HASKOS_DATABASE_URL="postgresql+asyncpg://fake:fake@localhost:5432/fake" \
  -e HASKOS_DEBUG=true \
  haskos-finance-test
sleep 3
docker logs haskos-finance-smoke 2>&1 || true
docker stop haskos-finance-smoke || true

Three independent reasons this was incapable of failing:

HASKOS_DEBUG=true. The kernel's validator is literally if self.debug: return self. This tested the one mode production never uses.
No liveness assertion. docker run -d exits 0 when the container starts, not when it survives. A crash-on-boot passes.
|| true on every observation, including the log read.

The fake DSN pointing at localhost:5432 inside the container also guaranteed the app could never finish booting — invisible for the same reasons.

Why now

The identical step in haskos-engineering passed an image that crashed on boot in production on 2026-07-27:

ValidationError: Insecure default secrets detected in non-debug mode.
Override these env vars before deploying: HASKOS_SESSION_SECRET

haskos_kernel.config instantiates Settings() at import time and rejects placeholder secrets — but only outside debug mode. This app's runtime is fine (HASKOS_SESSION_SECRET is set on its Dokku app and it has been up and healthy for days). This is a gate defect, not an outage.

What it does now

Sibling Postgres on its own network, no HASKOS_DEBUG, dummy secrets that are present-and-valid rather than absent, then two assertions: the container is still State.Running, and /health answers.

The second is not redundant — /health only responds after lifespan completes.

Verified by making it fail

Ran the new logic against dokku/haskos-finance:latest on contabo-sg:

haskos-finance  with     -> PASS            (Application startup complete)
haskos-finance  without  -> FAIL(exit 1)    (Insecure default secrets ... HASKOS_SESSION_SECRET)

The old step passes both. That difference is the PR.

Ported from haskos-engineering PR #10.

## The check could not fail ```yaml docker run --rm -d --name haskos-finance-smoke \ -e HASKOS_DATABASE_URL="postgresql+asyncpg://fake:fake@localhost:5432/fake" \ -e HASKOS_DEBUG=true \ haskos-finance-test sleep 3 docker logs haskos-finance-smoke 2>&1 || true docker stop haskos-finance-smoke || true ``` Three independent reasons this was incapable of failing: 1. **`HASKOS_DEBUG=true`.** The kernel's validator is literally `if self.debug: return self`. This tested the one mode production never uses. 2. **No liveness assertion.** `docker run -d` exits 0 when the container *starts*, not when it survives. A crash-on-boot passes. 3. **`|| true` on every observation**, including the log read. The fake DSN pointing at `localhost:5432` *inside* the container also guaranteed the app could never finish booting — invisible for the same reasons. ## Why now The identical step in `haskos-engineering` passed an image that crashed on boot in production on 2026-07-27: ``` ValidationError: Insecure default secrets detected in non-debug mode. Override these env vars before deploying: HASKOS_SESSION_SECRET ``` `haskos_kernel.config` instantiates `Settings()` at **import time** and rejects placeholder secrets — but only outside debug mode. **This app's runtime is fine** (`HASKOS_SESSION_SECRET` is set on its Dokku app and it has been up and healthy for days). This is a gate defect, not an outage. ## What it does now Sibling Postgres on its own network, **no `HASKOS_DEBUG`**, dummy secrets that are present-and-valid rather than absent, then two assertions: the container is still `State.Running`, and `/health` answers. The second is not redundant — `/health` only responds after lifespan completes. ## Verified by making it fail Ran the new logic against `dokku/haskos-finance:latest` on contabo-sg: ``` haskos-finance with -> PASS (Application startup complete) haskos-finance without -> FAIL(exit 1) (Insecure default secrets ... HASKOS_SESSION_SECRET) ``` The old step passes both. That difference is the PR. Ported from `haskos-engineering` PR #10.

john added 1 commit

2026-07-26 23:11:26 +00:00

fix(ci): smoke test boots the way production boots, and can fail

CI / Deploy (pull_request) Has been skipped

Details

CI / Backend (pull_request) Has been cancelled

Details

CI / Detect Changes (pull_request) Has been cancelled

Details

CI / Docker Build (pull_request) Has been cancelled

Details

3e9d2f921c

The Docker Build smoke test ran with HASKOS_DEBUG=true against a fake database,
never asserted the container was still alive, and ended every command in
|| true. It could not fail.

The identical shape in haskos-engineering passed an image that crashed on boot
in production on 2026-07-27: haskos_kernel.config instantiates Settings() at
import time and rejects placeholder secrets, but only in non-debug mode -- the
one mode the smoke test never used.

Now: a sibling Postgres on its own network, no HASKOS_DEBUG, present-and-valid
dummy secrets, then assert State.Running and that /health answers.

Verified both directions against the real image on contabo-sg: PASS with
HASKOS_SESSION_SECRET set, FAIL(exit 1) without it. The old test passes both.