ci: add rollback-aware production smoke checks

.gitea/workflows/deploy.yml

@@ -12,9 +12,10 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  test:
+  release-check:
     if: ${{ github.event.pull_request.merged == true }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     services:
       mysql:
         image: mysql:8.0.35
@@ -44,44 +45,41 @@ jobs:
             python3-dev \
             python3-venv
 
-      - name: 安装测试依赖
+      - name: 安装发布检查依赖
         run: |
-          python3 -m venv .venv-ci
-          .venv-ci/bin/python -m pip install \
+          python3 -m venv .venv-release
+          .venv-release/bin/python -m pip install \
             --index-url https://mirrors.aliyun.com/pypi/simple \
             --timeout 120 \
             --retries 5 \
-            -r requirements-dev.txt
+            -r requirements.txt
 
       - name: 检查迁移文件
         working-directory: backend
-        run: ../.venv-ci/bin/python manage.py makemigrations --check --dry-run
+        run: ../.venv-release/bin/python manage.py makemigrations --check --dry-run
 
       - name: Django 系统检查
         working-directory: backend
-        run: ../.venv-ci/bin/python manage.py check
+        run: ../.venv-release/bin/python manage.py check
 
       - name: ASGI 启动导入检查
         working-directory: backend
-        run: ../.venv-ci/bin/python -c "from config.asgi import application; print(type(application).__name__)"
+        run: ../.venv-release/bin/python -c "from config.asgi import application; print(type(application).__name__)"
 
-      - name: 运行测试
-        run: .venv-ci/bin/python -m pytest -q
-
-      - name: MySQL 迁移与全量测试
+      - name: MySQL 发布迁移检查
         env:
           DATABASE_URL: mysql://root:ci-root-password@mysql:3306/hulumath
         run: |
-          .venv-ci/bin/python backend/manage.py check --database default
-          .venv-ci/bin/python backend/manage.py check_mysql
-          .venv-ci/bin/python backend/manage.py migrate --noinput
-          .venv-ci/bin/python -m pytest -q
+          .venv-release/bin/python backend/manage.py check --database default
+          .venv-release/bin/python backend/manage.py check_mysql
+          .venv-release/bin/python backend/manage.py migrate --noinput
 
   deploy:
     if: ${{ github.event.pull_request.merged == true }}
     needs:
-      - test
+      - release-check
     runs-on: ubuntu-latest
+    timeout-minutes: 25
     steps:
       - name: 配置 SSH 环境
         env:
@@ -92,7 +90,7 @@ jobs:
           mkdir -p ~/.ssh
           printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts
+          timeout 10 ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts
 
       - name: 远程执行 Django 部署
         env:
@@ -139,6 +137,8 @@ jobs:
           PROJECT_DIR="$PROJECT" \
           PYTHON_BIN="$PYTHON_BIN" \
           PREVIOUS_REVISION="$PREVIOUS_REVISION" \
+          DEPLOY_SMOKE_BASE_URL="http://127.0.0.1:4321" \
+          DEPLOY_SMOKE_WS_URL="ws://127.0.0.1:4321/ws/health/" \
             bash scripts/deploy_production.sh
 
           echo "========================================"
@@ -146,3 +146,13 @@ jobs:
           echo "========================================"
 
           EOF
+
+      - name: 从 Runner 验证 Nginx 健康状态
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+        run: |
+          curl --fail --silent --show-error \
+            --retry 5 \
+            --retry-delay 2 \
+            "http://$DEPLOY_HOST:4321/health/" \
+            | grep -q '"status": "ok"'