deploy-action.yml

name: Deploy actions

on:
  pull_request:
    paths:
      - .github/actions/**
      - .github/workflows/**
      - .github/zizmor.yml
      - scripts/install-actionlint.sh
      - scripts/install-yq.sh
      - Cargo.toml
      - Cargo.lock
      - .tool-versions
      - crates/edgezero-adapter/**
      - crates/edgezero-adapter-fastly/**
      - crates/edgezero-cli/**
      - crates/edgezero-core/**
      - crates/edgezero-macros/**
      - docs/guide/deploy-github-actions.md
      - docs/guide/deploy-action-adoption.md
      - docs/superpowers/specs/*-edgezero-deploy-*.md
      - docs/superpowers/plans/*-edgezero-deploy-*.md
  push:
    branches: [main]
    paths:
      - .github/actions/**
      - .github/workflows/**
      - .github/zizmor.yml
      - scripts/install-actionlint.sh
      - scripts/install-yq.sh
      - Cargo.toml
      - Cargo.lock
      - .tool-versions
      - crates/edgezero-adapter/**
      - crates/edgezero-adapter-fastly/**
      - crates/edgezero-cli/**
      - crates/edgezero-core/**
      - crates/edgezero-macros/**
      - docs/guide/deploy-github-actions.md
      - docs/guide/deploy-action-adoption.md
      - docs/superpowers/specs/*-edgezero-deploy-*.md
      - docs/superpowers/plans/*-edgezero-deploy-*.md

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  ACTIONLINT_VERSION: 1.7.7
  ZIZMOR_VERSION: 1.16.3
  YQ_VERSION: 4.53.3

jobs:
  static-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install pinned validation binaries
        run: |
          bin="$RUNNER_TEMP/tools/bin"
          mkdir -p "$bin"
          INSTALL_DIR="$bin" scripts/install-actionlint.sh "$ACTIONLINT_VERSION"
          INSTALL_DIR="$bin" scripts/install-yq.sh "$YQ_VERSION"
          cargo install zizmor --version "$ZIZMOR_VERSION" --locked --root "$RUNNER_TEMP/tools"
          "$bin/actionlint" -version | grep -qF "$ACTIONLINT_VERSION"
          "$bin/yq" --version | grep -qF "version v$YQ_VERSION"
          "$bin/zizmor" --version | grep -qF "$ZIZMOR_VERSION"
          printf '%s\n' "$bin" >>"$GITHUB_PATH"

      - name: Install ShellCheck
        run: |
          sudo apt-get update
          sudo apt-get install -y shellcheck

      - name: Actionlint
        run: |
          "$RUNNER_TEMP/tools/bin/actionlint" -shellcheck='shellcheck -S warning'

      - name: Third-party action pin gate
        run: .github/actions/deploy-core/tests/check-action-pins.sh

      - name: Zizmor security scan
        run: '"$RUNNER_TEMP/tools/bin/zizmor" --offline .github'

      - name: ShellCheck action scripts
        run: |
          shellcheck -e SC1091 \
            .github/actions/*/scripts/*.sh \
            .github/actions/*/tests/*.sh \
            .github/actions/deploy-core/tests/*.sh \
            scripts/install-actionlint.sh \
            scripts/install-yq.sh

      - name: Bash contract tests
        run: .github/actions/deploy-core/tests/run.sh

      - name: Rust build-cache action tests
        run: .github/actions/setup-rust-build-cache/tests/run.sh

      - name: Validate docs
        run: |
          cd docs
          npm ci
          npm run format
          npm run lint
          npm run build

  # Exercise source reuse and revision-isolated target caching across real jobs.
  # Run-specific compiler inputs prevent accidental hits from older smoke runs.
  # The tiny per-run target archive lets downstream jobs verify exact restores.
  cache-restore-seed:
    runs-on: ubuntu-latest
    outputs:
      fixture-id: ${{ steps.fixture.outputs.fixture-id }}
      source-cache-key: ${{ steps.cache.outputs.source-cache-key }}
      target-cache-key: ${{ steps.cache.outputs.target-cache-key }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Create cache restore fixture
        id: fixture
        run: bash .github/actions/setup-rust-build-cache/tests/make-fixture.sh seed

      - name: Install native and WASM compiler targets
        run: bash .github/actions/setup-rust-build-cache/tests/setup-toolchain.sh

      - name: Seed the provider-neutral Rust target cache
        id: cache
        uses: ./.github/actions/setup-rust-build-cache
        with:
          app-name: cache-restore-smoke-v2
          cache-target: true
          save-target: true
          target-cache-revision: ${{ steps.fixture.outputs.revision }}
          working-directory: cache-restore-fixture

      - name: Write restore marker
        run: |
          printf '%s\n' 'edgezero-cache-restore-smoke-v2' >"$CARGO_TARGET_DIR/restore-marker"
          mkdir -p "$HOME/.cargo/git/db"
          printf '%s\n' 'edgezero-source-cache-smoke-v2' >"$HOME/.cargo/git/db/edgezero-source-cache-smoke-v2"

      - name: Seed native and WASM compiler outputs
        working-directory: cache-restore-fixture
        run: |
          host=$(rustc -vV | sed -n 's/^host: //p')
          test -n "$host"
          cargo build --locked --lib --target "$host"
          cargo build --locked --lib --target wasm32-wasip1

  cache-restore-smoke:
    needs: cache-restore-seed
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Recreate cache restore fixture
        id: fixture
        env:
          CACHE_FIXTURE_ID: ${{ needs.cache-restore-seed.outputs.fixture-id }}
        run: bash .github/actions/setup-rust-build-cache/tests/make-fixture.sh seed

      - name: Install native and WASM compiler targets
        run: bash .github/actions/setup-rust-build-cache/tests/setup-toolchain.sh

      - name: Restore the provider-neutral Rust target cache
        id: cache
        uses: ./.github/actions/setup-rust-build-cache
        with:
          app-name: cache-restore-smoke-v2
          cache-target: true
          target-cache-revision: ${{ steps.fixture.outputs.revision }}
          working-directory: cache-restore-fixture

      - name: Assert target cache restored across jobs
        env:
          TARGET_CACHE_HIT: ${{ steps.cache.outputs.target-cache-hit }}
        run: |
          test "$TARGET_CACHE_HIT" = true
          grep -Fxq 'edgezero-cache-restore-smoke-v2' "$CARGO_TARGET_DIR/restore-marker"

  cache-new-revision-smoke:
    needs: cache-restore-seed
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Create a different fixture source revision
        id: fixture
        env:
          CACHE_FIXTURE_ID: ${{ needs.cache-restore-seed.outputs.fixture-id }}
        run: bash .github/actions/setup-rust-build-cache/tests/make-fixture.sh next
      - name: Install native and WASM compiler targets
        run: bash .github/actions/setup-rust-build-cache/tests/setup-toolchain.sh
      - name: Set up revision-isolated target cache
        id: cache
        uses: ./.github/actions/setup-rust-build-cache
        with:
          app-name: cache-restore-smoke-v2
          cache-target: true
          target-cache-revision: ${{ steps.fixture.outputs.revision }}
          working-directory: cache-restore-fixture
      - name: Assert sources are reused but target artifacts are isolated
        env:
          SOURCE_CACHE_HIT: ${{ steps.cache.outputs.source-cache-hit }}
          TARGET_CACHE_HIT: ${{ steps.cache.outputs.target-cache-hit }}
          SOURCE_CACHE_KEY: ${{ steps.cache.outputs.source-cache-key }}
          TARGET_CACHE_KEY: ${{ steps.cache.outputs.target-cache-key }}
          SEED_SOURCE_KEY: ${{ needs.cache-restore-seed.outputs.source-cache-key }}
          SEED_TARGET_KEY: ${{ needs.cache-restore-seed.outputs.target-cache-key }}
        run: |
          test "$SOURCE_CACHE_HIT" = true
          test "$TARGET_CACHE_HIT" = false
          test "$SOURCE_CACHE_KEY" = "$SEED_SOURCE_KEY"
          test "$TARGET_CACHE_KEY" != "$SEED_TARGET_KEY"
          test ! -e "$CARGO_TARGET_DIR/restore-marker"
          grep -Fxq 'edgezero-source-cache-smoke-v2' "$HOME/.cargo/git/db/edgezero-source-cache-smoke-v2"
      - name: Assert native and WASM compiler cache reuse
        run: bash .github/actions/setup-rust-build-cache/tests/assert-compiler-reuse.sh

  # Build the store-aware application once. Its production/staging matrix and
  # lifecycle actions consume these exact CLI, package, and manifest bytes.
  fixture-release:
    runs-on: ubuntu-latest
    outputs:
      app-release-sha256: ${{ steps.release.outputs.archive-sha256 }}
      package-digest: ${{ steps.release.outputs.package-sha256 }}
      source-revision: ${{ steps.release.outputs.source-revision }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Create the store-aware fixture application
        run: .github/actions/deploy-fastly/tests/make-smoke-fixture.sh source store-aware

      - name: Record fixture revision and prebuilt package
        id: fixture
        run: |
          printf 'immutable fixture Fastly package\n' >fixture-app/package.tar.gz
          printf 'revision=%s\n' "$(git -C fixture-app rev-parse HEAD)" >>"$GITHUB_OUTPUT"

      - name: Install pinned yq
        run: |
          mkdir -p "$RUNNER_TEMP/tools/bin"
          INSTALL_DIR="$RUNNER_TEMP/tools/bin" scripts/install-yq.sh "$YQ_VERSION"
          printf '%s\n' "$RUNNER_TEMP/tools/bin" >>"$GITHUB_PATH"

      - name: Set up Rust build cache
        uses: ./.github/actions/setup-rust-build-cache
        with:
          app-name: store-aware-fixture
          cache-target: false
          working-directory: fixture-app

      - name: Build the application-owned CLI once
        uses: ./.github/actions/build-app-cli
        with:
          app-cli-package: fixture-app-cli
          working-directory: fixture-app
          app-cli-artifact: fixture-app-cli

      - name: Download the one application CLI archive
        uses: actions/download-artifact@v8
        with:
          name: fixture-app-cli
          path: fixture-cli

      - name: Assemble the immutable application release
        id: release
        uses: ./.github/actions/package-application-release-fastly
        with:
          app-cli-archive: fixture-cli/app-cli.tar
          fastly-package: fixture-app/package.tar.gz
          application-manifest: fixture-app/edgezero.toml
          adapter-manifest: fixture-app/adapter/fastly.toml
          source-revision: ${{ steps.fixture.outputs.revision }}
          artifact-name: edgezero-fastly-release

  # This is a separate application release because its bundled edgezero.toml
  # declares no stores. It is built once and is never varied by a deployer.
  store-free-release:
    runs-on: ubuntu-latest
    outputs:
      app-release-sha256: ${{ steps.release.outputs.archive-sha256 }}
      package-digest: ${{ steps.release.outputs.package-sha256 }}
      source-revision: ${{ steps.release.outputs.source-revision }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Create the store-free fixture application
        run: .github/actions/deploy-fastly/tests/make-smoke-fixture.sh source store-free

      - name: Record fixture revision and prebuilt package
        id: fixture
        run: |
          printf 'immutable fixture Fastly package\n' >fixture-app/package.tar.gz
          printf 'revision=%s\n' "$(git -C fixture-app rev-parse HEAD)" >>"$GITHUB_OUTPUT"

      - name: Install pinned yq
        run: |
          mkdir -p "$RUNNER_TEMP/tools/bin"
          INSTALL_DIR="$RUNNER_TEMP/tools/bin" scripts/install-yq.sh "$YQ_VERSION"
          printf '%s\n' "$RUNNER_TEMP/tools/bin" >>"$GITHUB_PATH"

      - name: Set up Rust build cache
        uses: ./.github/actions/setup-rust-build-cache
        with:
          app-name: store-free-fixture
          cache-target: false
          working-directory: fixture-app

      - name: Build the store-free application CLI once
        uses: ./.github/actions/build-app-cli
        with:
          app-cli-package: fixture-app-cli
          working-directory: fixture-app
          app-cli-artifact: fixture-app-cli-store-free

      - name: Download the store-free application CLI archive
        uses: actions/download-artifact@v8
        with:
          name: fixture-app-cli-store-free
          path: fixture-cli

      - name: Assemble the immutable store-free application release
        id: release
        uses: ./.github/actions/package-application-release-fastly
        with:
          app-cli-archive: fixture-cli/app-cli.tar
          fastly-package: fixture-app/package.tar.gz
          application-manifest: fixture-app/edgezero.toml
          adapter-manifest: fixture-app/adapter/fastly.toml
          source-revision: ${{ steps.fixture.outputs.revision }}
          artifact-name: edgezero-fastly-store-free-release

  production-smoke:
    needs: fixture-release
    runs-on: ubuntu-latest
    env:
      EDGEZERO__STORES__CONFIG__APP_CONFIG__NAME: config-prod
      EDGEZERO__STORES__KV__CACHE__NAME: cache-prod
      EDGEZERO__STORES__SECRETS__CREDENTIALS__NAME: credentials-prod
      FASTLY_ENDPOINT: https://inherited.invalid
      FASTLY_HOME: /nonexistent/inherited
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/download-artifact@v8
        with:
          name: edgezero-fastly-release
          path: fixture-release
      - name: Install the stateful fake Fastly provider
        env:
          FAKE_EXPECTED_PACKAGE_DIGEST: ${{ needs.fixture-release.outputs.package-digest }}
        run: .github/actions/deploy-fastly/tests/make-fake-fastly-env.sh

      - name: Deploy the immutable release to production
        id: deploy
        uses: ./.github/actions/deploy-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice
          deploy-args: '["--comment","production smoke"]'

      - name: Assert the production resource links and package
        env:
          EDGEZERO__TEST__FASTLY_VERSION: ${{ steps.deploy.outputs.fastly-version }}
          EDGEZERO__TEST__PREVIOUS_VERSION: ${{ steps.deploy.outputs.previous-version }}
          EDGEZERO__TEST__PACKAGE_DIGEST: ${{ steps.deploy.outputs.package-digest }}
        run: .github/actions/deploy-fastly/tests/assert-production-deploy.sh

      - name: Probe production using the same immutable release
        uses: ./.github/actions/healthcheck-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          deploy-to: production
          domain: app.example.com
          fastly-version: ${{ steps.deploy.outputs.fastly-version }}
          fastly-service-id: dummyservice
          retry: "1"
          retry-delay: "1"

      - name: Roll production back using the same immutable release
        id: rollback
        uses: ./.github/actions/rollback-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice
          fastly-version: ${{ steps.deploy.outputs.fastly-version }}
          rollback-to: ${{ steps.deploy.outputs.previous-version }}

      - name: Assert rollback used the captured version
        env:
          EDGEZERO__TEST__ROLLED_BACK_TO: ${{ steps.rollback.outputs.rolled-back-to }}
          EDGEZERO__TEST__PREVIOUS_VERSION: ${{ steps.deploy.outputs.previous-version }}
        run: .github/actions/deploy-fastly/tests/assert-rollback-threaded.sh

  store-free-deploy-smoke:
    needs: store-free-release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/download-artifact@v8
        with:
          name: edgezero-fastly-store-free-release
          path: fixture-release
      - name: Install the stateful fake Fastly provider
        env:
          FAKE_EXPECTED_PACKAGE_DIGEST: ${{ needs.store-free-release.outputs.package-digest }}
        run: .github/actions/deploy-fastly/tests/make-fake-fastly-env.sh

      - name: Deploy the immutable store-free release through the adapter
        id: deploy
        uses: ./.github/actions/deploy-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.store-free-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.store-free-release.outputs.source-revision }}
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice
          deploy-args: '["--comment","store-free managed smoke"]'

      - name: Assert the store-free release used managed deployment
        env:
          EDGEZERO__TEST__FASTLY_VERSION: ${{ steps.deploy.outputs.fastly-version }}
          EDGEZERO__TEST__FIXTURE_MODE: store-free
          EDGEZERO__TEST__PREVIOUS_VERSION: ${{ steps.deploy.outputs.previous-version }}
          EDGEZERO__TEST__PACKAGE_DIGEST: ${{ steps.deploy.outputs.package-digest }}
        run: .github/actions/deploy-fastly/tests/assert-production-deploy.sh

  staging-smoke:
    needs: fixture-release
    runs-on: ubuntu-latest
    env:
      EDGEZERO__STORES__CONFIG__APP_CONFIG__NAME: config-stage
      EDGEZERO__STORES__KV__CACHE__NAME: cache-stage
      EDGEZERO__STORES__SECRETS__CREDENTIALS__NAME: credentials-stage
      FASTLY_API_TOKEN: inherited-must-not-reach-production-probes
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/download-artifact@v8
        with:
          name: edgezero-fastly-release
          path: fixture-release
      - name: Install the stateful fake Fastly provider
        env:
          FAKE_EXPECTED_PACKAGE_DIGEST: ${{ needs.fixture-release.outputs.package-digest }}
        run: .github/actions/deploy-fastly/tests/make-fake-fastly-env.sh

      - name: Deploy the same immutable release to staging
        id: stage
        uses: ./.github/actions/deploy-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice
          deploy-args: '["--comment","staged smoke"]'
          deploy-to: staging

      - name: Assert staging resource links and package
        env:
          EDGEZERO__TEST__STAGED_VERSION: ${{ steps.stage.outputs.fastly-version }}
          EDGEZERO__TEST__PACKAGE_DIGEST: ${{ steps.stage.outputs.package-digest }}
        run: .github/actions/deploy-fastly/tests/assert-staged-calls.sh

      - name: Probe staging using the same immutable release
        id: health
        uses: ./.github/actions/healthcheck-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          deploy-to: staging
          domain: app.example.com
          fastly-version: ${{ steps.stage.outputs.fastly-version }}
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice
          retry: "1"
          retry-delay: "1"

      - name: Assert the staged IP was probed
        env:
          EDGEZERO__TEST__GITHUB_ENVIRONMENT: staging.app.example.com
          EDGEZERO__TEST__STAGED_VERSION: ${{ steps.stage.outputs.fastly-version }}
          EDGEZERO__TEST__HEALTHY: ${{ steps.health.outputs.healthy }}
          EDGEZERO__TEST__STATUS_CODE: ${{ steps.health.outputs.status-code }}
        run: .github/actions/deploy-fastly/tests/assert-staging-probe.sh

      - name: Unhealthy staging probe fails
        id: unhealthy
        continue-on-error: true
        uses: ./.github/actions/healthcheck-fastly
        env:
          FORCE_UNHEALTHY: "1"
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          deploy-to: staging
          domain: app.example.com
          fastly-version: ${{ steps.stage.outputs.fastly-version }}
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice
          retry: "1"
          retry-delay: "1"

      - name: Assert unhealthy staging probe failed
        env:
          EDGEZERO__TEST__OUTCOME: ${{ steps.unhealthy.outcome }}
          EDGEZERO__TEST__HEALTHY: ${{ steps.unhealthy.outputs.healthy }}
          EDGEZERO__TEST__STATUS_CODE: ${{ steps.unhealthy.outputs.status-code }}
        run: .github/actions/deploy-fastly/tests/assert-unhealthy-failed.sh

      - name: Snapshot calls before tokenless production probe
        run: printf 'PROD_PROBE_SNAPSHOT=%s\n' "$(wc -l <"$FAKE_CALL_LOG")" >>"$GITHUB_ENV"

      - name: Probe production without a provider token
        id: production-health
        uses: ./.github/actions/healthcheck-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          deploy-to: production
          domain: app.example.com
          fastly-version: ${{ steps.stage.outputs.fastly-version }}
          fastly-service-id: dummyservice
          retry: "1"
          retry-delay: "1"

      - name: Assert production probe received no token
        env:
          EDGEZERO__TEST__LOG_SNAPSHOT: ${{ env.PROD_PROBE_SNAPSHOT }}
          EDGEZERO__TEST__HEALTHY: ${{ steps.production-health.outputs.healthy }}
        run: .github/actions/deploy-fastly/tests/assert-production-probe-tokenless.sh

      - name: Refuse staging probe without a provider token
        id: staging-no-token
        continue-on-error: true
        uses: ./.github/actions/healthcheck-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          deploy-to: staging
          domain: app.example.com
          fastly-version: ${{ steps.stage.outputs.fastly-version }}
          fastly-service-id: dummyservice
          retry: "1"
          retry-delay: "1"

      - name: Assert tokenless staging probe was refused
        env:
          EDGEZERO__TEST__OUTCOME: ${{ steps.staging-no-token.outcome }}
        run: |
          [[ "$EDGEZERO__TEST__OUTCOME" == failure ]] || {
            echo "::error::tokenless staging healthcheck was not refused"
            exit 1
          }

      - name: Roll staging back using the same immutable release
        uses: ./.github/actions/rollback-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          deploy-to: staging
          fastly-version: ${{ steps.stage.outputs.fastly-version }}
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice

      - name: Assert staging rollback deactivated version 42
        run: grep -q '^PUT https://api.fastly.com/service/dummyservice/version/42/deactivate/staging$' "$FAKE_CALL_LOG"

      - name: Roll active production version 40 back to 39
        id: production-rollback
        uses: ./.github/actions/rollback-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          deploy-to: production
          fastly-version: "40"
          rollback-to: "39"
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice

      - name: Assert rollback verbs and version threading
        env:
          EDGEZERO__TEST__STAGED_VERSION: ${{ steps.stage.outputs.fastly-version }}
          EDGEZERO__TEST__ROLLED_BACK_TO: ${{ steps.production-rollback.outputs.rolled-back-to }}
        run: .github/actions/deploy-fastly/tests/assert-rollback-calls.sh

      - name: Refuse a production rollback without a target
        id: rollback-no-target
        continue-on-error: true
        uses: ./.github/actions/rollback-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          deploy-to: production
          fastly-version: "39"
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice

      - name: Assert targetless rollback was refused
        env:
          EDGEZERO__TEST__OUTCOME: ${{ steps.rollback-no-target.outcome }}
        run: |
          [[ "$EDGEZERO__TEST__OUTCOME" == failure ]] || {
            echo "::error::targetless production rollback was not refused"
            exit 1
          }

      - name: Simulate a newer active version and snapshot calls
        run: |
          printf '99\n' >"$FAKE_ACTIVE_VERSION_FILE"
          printf 'STALE_LOG_SNAPSHOT=%s\n' "$(wc -l <"$FAKE_CALL_LOG")" >>"$GITHUB_ENV"

      - name: Refuse stale production rollback
        id: stale-rollback
        continue-on-error: true
        uses: ./.github/actions/rollback-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          deploy-to: production
          fastly-version: "39"
          rollback-to: "38"
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice

      - name: Assert stale rollback mutated nothing
        env:
          EDGEZERO__TEST__OUTCOME: ${{ steps.stale-rollback.outcome }}
          EDGEZERO__TEST__LOG_SNAPSHOT: ${{ env.STALE_LOG_SNAPSHOT }}
        run: .github/actions/deploy-fastly/tests/assert-stale-rollback-refused.sh

  config-push-smoke:
    needs: fixture-release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/download-artifact@v8
        with:
          name: edgezero-fastly-release
          path: fixture-release
      - name: Install fake Fastly for publisher B
        run: .github/actions/deploy-fastly/tests/make-fake-fastly-env.sh

      - name: Push publisher B staging config from the bundled manifest
        id: staged
        uses: ./.github/actions/config-push-fastly
        env:
          EDGEZERO__STORES__CONFIG__APP_CONFIG__NAME: config-stage
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          app-config-inline: 'greeting = "publisher B"'
          fastly-api-token: dummy-token
          deploy-to: staging

      - name: Assert publisher B staging config
        env:
          EDGEZERO__TEST__EXPECT_KEY: app_config
          EDGEZERO__TEST__REJECT_KEY: app_config_staging
          EDGEZERO__TEST__PUSHED_KEY: ${{ steps.staged.outputs.pushed-key }}
          EDGEZERO__TEST__PUSHED_STORE: ${{ steps.staged.outputs.store }}
        run: .github/actions/deploy-fastly/tests/assert-config-push.sh

      - name: Reset fake Fastly for publisher A
        run: .github/actions/deploy-fastly/tests/make-fake-fastly-env.sh

      - name: Push publisher A production config from the bundled manifest
        id: production
        uses: ./.github/actions/config-push-fastly
        env:
          EDGEZERO__STORES__CONFIG__APP_CONFIG__NAME: config-prod
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          app-config-inline: 'greeting = "publisher A"'
          fastly-api-token: dummy-token

      - name: Assert publisher A production config
        env:
          EDGEZERO__TEST__EXPECT_KEY: app_config
          EDGEZERO__TEST__REJECT_KEY: app_config_staging
          EDGEZERO__TEST__PUSHED_KEY: ${{ steps.production.outputs.pushed-key }}
          EDGEZERO__TEST__PUSHED_STORE: ${{ steps.production.outputs.store }}
        run: .github/actions/deploy-fastly/tests/assert-config-push.sh

  recovery-smoke:
    needs: fixture-release
    runs-on: ubuntu-latest
    env:
      EDGEZERO__STORES__CONFIG__APP_CONFIG__NAME: config-prod
      EDGEZERO__STORES__KV__CACHE__NAME: cache-prod
      EDGEZERO__STORES__SECRETS__CREDENTIALS__NAME: credentials-prod
      FAKE_FAIL_AFTER_ACTIVATION: "1"
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/download-artifact@v8
        with:
          name: edgezero-fastly-release
          path: fixture-release
      - name: Install the stateful fake Fastly provider
        env:
          FAKE_EXPECTED_PACKAGE_DIGEST: ${{ needs.fixture-release.outputs.package-digest }}
        run: .github/actions/deploy-fastly/tests/make-fake-fastly-env.sh

      - name: Model activation committed before a failed provider response
        id: deploy
        continue-on-error: true
        uses: ./.github/actions/deploy-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice

      - name: Assert failed deployment retained recovery outputs
        env:
          EDGEZERO__TEST__DEPLOY_OUTCOME: ${{ steps.deploy.outcome }}
          EDGEZERO__TEST__MUTATION_ATTEMPTED: ${{ steps.deploy.outputs.mutation-attempted }}
          EDGEZERO__TEST__PREVIOUS_VERSION: ${{ steps.deploy.outputs.previous-version }}
          EDGEZERO__TEST__FASTLY_VERSION: ${{ steps.deploy.outputs.fastly-version }}
          EDGEZERO__TEST__PACKAGE_DIGEST: ${{ steps.deploy.outputs.package-digest }}
        run: .github/actions/deploy-fastly/tests/assert-lost-version.sh

      - name: Recover the exact live production version
        id: recover
        env:
          FASTLY_API_TOKEN: dummy-token
          FASTLY_SERVICE_ID: dummyservice
        run: .github/actions/deploy-fastly/tests/recovery-active-version.sh fixture-release

      - name: Roll back the ambiguously published version
        id: rollback
        uses: ./.github/actions/rollback-fastly
        with:
          app-release-archive: ${{ github.workspace }}/fixture-release/app-release.tar.gz
          app-release-sha256: ${{ needs.fixture-release.outputs.app-release-sha256 }}
          expected-source-revision: ${{ needs.fixture-release.outputs.source-revision }}
          fastly-api-token: dummy-token
          fastly-service-id: dummyservice
          fastly-version: ${{ steps.recover.outputs.version }}
          rollback-to: ${{ steps.deploy.outputs.previous-version }}

      - name: Assert recovery restored the previous version
        env:
          EDGEZERO__TEST__ROLLED_BACK_TO: ${{ steps.rollback.outputs.rolled-back-to }}
        run: .github/actions/deploy-fastly/tests/assert-recovery-rollback.sh