Repository navigation
The health gate can only check one HTTP status, so a deploy can't run a smoke check before it keeps a release #152
Description
What happens
Component.healthCheck is http (one local URL, expected statuses) or none. release.command runs before the switch, so it cannot test the new release while it serves. Nothing runs after the switch that can fail the deploy and trigger the existing rollback.
Checked on main (27d4f88, 0.7.0): config/schemas/v1/component.schema.json (healthCheck oneOf), cloudfall_deploy "Activate the release behind the health gate".
Why it matters
Our as-rest deploy keeps a release only when a smoke check passes: authenticated calls to the routes customers use, with a dedicated API key from the service environment (it caught a 500 on every authenticated route that a status check on /health would have passed). Without a check of that kind in the gate, we run it as a separate CI step after cloudfall deploy and call cloudfall rollback ourselves, which leaves a window where the bad release serves and the rollback lives outside the receipt.
Asked
A healthCheck of type: command: an argv run on the server after the switch, as the component's user, with its working directory current and its environment file, with timeoutSeconds and attempts like http. A non-zero exit takes the existing rescue path (previous release restored and restarted), and the receipt records the command's exit code but not its output, which may hold secrets.
Done when
A test deploys a release whose command check exits non-zero and finds the previous release active and the receipt marked failed with the command's exit code.
Activity
shipmill-romamo commentedon Oct 28, 2026
Triage: feature. A
healthCheckoftype: commandis new behaviour of the deploy gate: a new schema variant, a command run on the server after the switch, and a receipt written on a failed deploy, which today writes none. A reviewer should approve its acceptance criteria before the code exists, so it goes through a spec rather than a contract tweak.Confirmed on
main(27d4f88):healthCheckishttpornone, the release command runs before the switch, and the receipt is written only once the gate passes, withhealthCheckPassedfixed totrueby its schema.The spec is in #153 (
docs/specs/009-command-health-check.md), with its acceptance criteria S-009-1 to S-009-13 and five choices under "Decisions for you" in its body: a receipt on a failed check, the command's output kept on the server only, the receipt's file, whetherrestart,rollbackandhealthrun the check too, and a fixed 3 s wait between attempts. Merging it is the approval, as is an answer on it that takes every recommendation, after which shipmill merges it once it is green; the build starts once it merges.On hold: the build waits on #153, the spec PR.
Spec 009: a command health check that gates a deploy (#153)
shipmill-romamo commentedon Oct 30, 2026
Built: spec S-009 (
docs/specs/009-command-health-check.md) isstatus: built, with a Verification line for each of its 13 criteria. A component can now declarehealthCheck: {type: command, ...}, and it gatesdeploy,restart,rollbackandhealth.effectrestart,rollbackandhealthNot yet run on a live Debian host: the tests use a stand-in for
systemd-run(see the spec's Verification).