Verify changed production CSS and rendered UI after QA-approved promotion

.github/workflows/deploy-timeweb.yml

@@ -2,7 +2,7 @@ name: Verify Caterium on Timeweb
 
 on:
   workflow_run:
-    workflows: ["Caterium QA"]
+    workflows: ["Caterium QA", "Caterium Direct Production"]
     types: [completed]
   workflow_dispatch:
 
@@ -18,69 +18,98 @@ jobs:
     if: >-
       github.event_name == 'workflow_dispatch' ||
       (github.event.workflow_run.conclusion == 'success' &&
-       github.event.workflow_run.head_branch == 'production')
+       ((github.event.workflow_run.name == 'Caterium QA' &&
+         github.event.workflow_run.head_branch == 'production') ||
+        (github.event.workflow_run.name == 'Caterium Direct Production' &&
+         github.event.workflow_run.head_branch == 'main')))
     runs-on: ubuntu-latest
+    timeout-minutes: 25
     env:
       TIMEWEB_BASE_URL: https://app.caterium.ru
 
     steps:
+      # A GITHUB_TOKEN push to production does not start another push workflow.
+      # Observe successful promotion directly and read its published branch.
       - name: Checkout tested production revision
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || 'production' }}
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.name == 'Caterium QA' && github.event.workflow_run.head_sha || 'production' }}
 
-      - name: Wait for Timeweb cron deployment
+      - name: Wait for the exact published assets
+        timeout-minutes: 18
         shell: bash
         run: |
           set -euo pipefail
-
+          files=(
-          login_file="public/core/login-signature-v1776.js"
+            index.html
-          logo_file="public/caterium-mark-light.svg"
+            app-runtime.js
-          sw_file="public/service-worker.js"
+            core/login-signature-v1776.js
-
+            core/login-signature-v1776.css
-          test -s "$login_file"
+            core/help-center.js
-          test -s "$logo_file"
+            core/help-center.css
-          test -s "$sw_file"
+            caterium-mark-light.svg
-
+            service-worker.js
-          local_login="$(sha256sum "$login_file" | awk '{print $1}')"
+          )
-          local_logo="$(sha256sum "$logo_file" | awk '{print $1}')"
+          temp_dir="$(mktemp -d)"
-          local_sw="$(sha256sum "$sw_file" | awk '{print $1}')"
+          trap 'rm -rf "$temp_dir"' EXIT
-
+          revision="$(git rev-parse HEAD)"
-          echo "Expected login sha256: $local_login"
+          echo "Verifying tested production revision: $revision"
-          echo "Expected logo sha256:  $local_logo"
+          for file in "${files[@]}"; do test -s "public/$file"; done
-          echo "Expected SW sha256:    $local_sw"
-
           for attempt in $(seq 1 18); do
             stamp="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${attempt}"
             echo "Attempt $attempt/18"
-
+            matched=true
-            if curl -fsSL --connect-timeout 10 --max-time 30 \
+            : > "$temp_dir/hashes.txt"
-                "${TIMEWEB_BASE_URL}/core/login-signature-v1776.js?deploy_check=${stamp}" \
+            for file in "${files[@]}"; do
-                -o /tmp/caterium-login.js && \
+              expected="$(sha256sum "public/$file" | awk '{print $1}')"
-               curl -fsSL --connect-timeout 10 --max-time 30 \
+              if ! curl -fsSL --connect-timeout 10 --max-time 20 \
-                "${TIMEWEB_BASE_URL}/caterium-mark-light.svg?deploy_check=${stamp}" \
+                  -H 'Cache-Control: no-cache' \
-                -o /tmp/caterium-mark.svg && \
+                  "${TIMEWEB_BASE_URL}/${file}?deploy_check=${stamp}" \
-               curl -fsSL --connect-timeout 10 --max-time 30 \
+                  -o "$temp_dir/asset"; then
-                "${TIMEWEB_BASE_URL}/service-worker.js?deploy_check=${stamp}" \
+                echo "Not reachable yet: $file"
-                -o /tmp/caterium-sw.js; then
+                matched=false
-              remote_login="$(sha256sum /tmp/caterium-login.js | awk '{print $1}')"
+                break
-              remote_logo="$(sha256sum /tmp/caterium-mark.svg | awk '{print $1}')"
-              remote_sw="$(sha256sum /tmp/caterium-sw.js | awk '{print $1}')"
-
-              echo "Remote login sha256: $remote_login"
-              echo "Remote logo sha256:  $remote_logo"
-              echo "Remote SW sha256:    $remote_sw"
-
-              if [ "$remote_login" = "$local_login" ] && [ "$remote_logo" = "$local_logo" ] && [ "$remote_sw" = "$local_sw" ]; then
-                echo "Timeweb production is current, including refreshed PWA cache."
-                exit 0
               fi
-            else
+              actual="$(sha256sum "$temp_dir/asset" | awk '{print $1}')"
-              echo "Timeweb is not reachable yet."
+              echo "$file expected=$expected actual=$actual"
+              if [ "$actual" != "$expected" ]; then
+                echo "Waiting for updated asset: $file"
+                matched=false
+                break
+              fi
+              printf '%s  %s\n' "$actual" "$file" >> "$temp_dir/hashes.txt"
+            done
+            if [ "$matched" = true ]; then
+              echo "PASS: all ${#files[@]} production assets match the tested revision."
+              {
+                echo '## Timeweb publication verified'
+                echo "Revision: \`$revision\`"
+                echo
+                echo 'All checked production assets match byte-for-byte:'
+                echo '```text'
+                cat "$temp_dir/hashes.txt"
+                echo '```'
+              } >> "$GITHUB_STEP_SUMMARY"
+              exit 0
             fi
-
             sleep 30
           done
-
+          echo '::error::Timeweb did not publish the tested assets within the allotted retries.'
-          echo "::error::Timeweb did not reach the tested Caterium revision within 9 minutes."
           exit 1
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm ci
+      - run: npx playwright install --with-deps chromium
+      - name: Check the published loading screen and Help icon
+        timeout-minutes: 4
+        run: node tests/production-ui-smoke.mjs
+      - name: Save production UI verification
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: production-ui-verification
+          path: production-ui-results/
+          if-no-files-found: ignore
+          retention-days: 7