fix(deploy): expose runtime build sha in production readback

apps/api/tests/test_awoooi_production_deploy_readback_blocker.py

@@ -0,0 +1,33 @@
+from __future__ import annotations
+
+from src.services.awoooi_production_deploy_readback_blocker import (
+    load_latest_awoooi_production_deploy_readback_blocker,
+)
+
+
+def test_production_deploy_readback_uses_runtime_build_commit(monkeypatch):
+    build_sha = "0123456789abcdef0123456789abcdef01234567"
+    monkeypatch.setenv("AWOOOI_BUILD_COMMIT_SHA", build_sha)
+
+    payload = load_latest_awoooi_production_deploy_readback_blocker()
+    readback = payload["readback"]
+    rollups = payload["rollups"]
+
+    assert readback["runtime_build_commit_sha"] == build_sha
+    assert readback["runtime_build_commit_short_sha"] == build_sha[:10]
+    assert readback["observed_source_control_main_sha"] == build_sha
+    assert readback["production_image_tag_sha"] == build_sha
+    assert readback["production_image_tag_matches_main"] is True
+    assert rollups["production_image_tag_matches_main"] is True
+
+
+def test_production_deploy_readback_ignores_non_sha_runtime_value(monkeypatch):
+    monkeypatch.setenv("AWOOOI_BUILD_COMMIT_SHA", "none")
+
+    payload = load_latest_awoooi_production_deploy_readback_blocker()
+    readback = payload["readback"]
+
+    assert "runtime_build_commit_sha" not in readback
+    assert readback["production_image_tag_sha"] == (
+        "a70c6756d9e76c33143676eef82bab7a49ac1839"
+    )

apps/api/tests/test_delivery_closure_workbench_api.py

@@ -4,6 +4,9 @@ from fastapi import FastAPI
 from fastapi.testclient import TestClient
 
 from src.api.v1.agents import router
+from src.services.awoooi_production_deploy_readback_blocker import (
+    load_latest_awoooi_production_deploy_readback_blocker,
+)
 
 
 def test_delivery_closure_workbench_endpoint_returns_product_summary():
@@ -597,3 +600,19 @@ def test_delivery_closure_workbench_endpoint_returns_product_summary():
     assert boundaries["active_scan_allowed"] is False
 
     assert "192.168.0." not in response.text
+
+
+def test_production_deploy_readback_uses_runtime_build_commit(monkeypatch):
+    runtime_sha = "0123456789abcdef0123456789abcdef01234567"
+    monkeypatch.setenv("AWOOOI_BUILD_COMMIT_SHA", runtime_sha)
+
+    payload = load_latest_awoooi_production_deploy_readback_blocker()
+    readback = payload["readback"]
+    rollups = payload["rollups"]
+
+    assert readback["runtime_build_commit_sha"] == runtime_sha
+    assert readback["runtime_build_commit_short_sha"] == runtime_sha[:10]
+    assert readback["observed_source_control_main_sha"] == runtime_sha
+    assert readback["production_image_tag_sha"] == runtime_sha
+    assert readback["production_image_tag_matches_main"] is True
+    assert rollups["production_image_tag_matches_main"] is True