fix: smoke test Hulumath over public TLS (#45)

.gitea/workflows/deploy.yml

@@ -105,8 +105,8 @@ jobs:
           PYTHON_BIN="$PYTHON_BIN" \
           PREVIOUS_REVISION="$PREVIOUS_REVISION" \
           DEPLOY_HEALTH_HOST="math.jacky0987.xyz" \
-          DEPLOY_SMOKE_BASE_URL="http://127.0.0.1:4321" \
-          DEPLOY_SMOKE_WS_URL="ws://127.0.0.1:4321/ws/health/" \
+          DEPLOY_SMOKE_BASE_URL="https://math.jacky0987.xyz" \
+          DEPLOY_SMOKE_WS_URL="wss://math.jacky0987.xyz/ws/health/" \
             bash scripts/deploy_production.sh
 
           echo "========================================"
@@ -116,13 +116,9 @@ jobs:
           EOF
 
       - name: 从 Runner 验证 Nginx 健康状态
-        env:
-          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
-          DEPLOY_PUBLIC_HOST: 117.72.28.96
         run: |
           curl --fail --silent --show-error \
             --retry 5 \
             --retry-delay 2 \
-            --header "Host: $DEPLOY_PUBLIC_HOST" \
-            "http://$DEPLOY_HOST:4321/health/" \
+            "https://math.jacky0987.xyz/health/" \
             | grep -q '"status": "ok"'

backend/common/test_deployment_security.py

@@ -13,6 +13,10 @@ def test_edge_hsts_ownership_is_explicit_and_verified():
     assert '["security.W004"]' in settings
     assert "DJANGO_HSTS_AT_EDGE=true" in workflow
     assert 'DEPLOY_HEALTH_HOST="math.jacky0987.xyz"' in workflow
+    assert 'DEPLOY_SMOKE_BASE_URL="https://math.jacky0987.xyz"' in workflow
+    assert 'DEPLOY_SMOKE_WS_URL="wss://math.jacky0987.xyz/ws/health/"' in workflow
+    assert '"https://math.jacky0987.xyz/health/"' in workflow
+    assert "127.0.0.1:4321" not in workflow
     assert "curl --silent --show-error --head" in deploy
     assert "curl --fail --silent --show-error --head" not in deploy
     assert "strict-transport-security:.*max-age=[1-9][0-9]*" in deploy