fix(api): verify production deploy image readback

apps/api/tests/test_awoooi_production_deploy_readback_blocker.py

@@ -1,26 +1,25 @@
 from __future__ import annotations
 
-from src.services.awoooi_production_deploy_readback_blocker import (
-    load_latest_awoooi_production_deploy_readback_blocker,
-)
+from src.services import awoooi_production_deploy_readback_blocker as service
 
 
-def test_production_deploy_readback_uses_runtime_build_commit(monkeypatch):
+_COMMITTED_SNAPSHOT_SHA = "a70c6756d9e76c33143676eef82bab7a49ac1839"
+
+
+def test_production_deploy_readback_verifies_runtime_build_against_gitops_desired(
+    monkeypatch,
+):
     build_sha = "0123456789abcdef0123456789abcdef01234567"
     monkeypatch.setenv("AWOOOI_BUILD_COMMIT_SHA", build_sha)
+    monkeypatch.setenv("AWOOOI_DESIRED_API_IMAGE_TAG", build_sha)
 
-    payload = load_latest_awoooi_production_deploy_readback_blocker()
+    payload = service.load_latest_awoooi_production_deploy_readback_blocker()
     readback = payload["readback"]
     rollups = payload["rollups"]
 
     assert readback["runtime_build_commit_sha"] == build_sha
     assert readback["runtime_build_commit_short_sha"] == build_sha[:10]
-    assert readback["observed_source_control_main_sha"] == (
-        "a70c6756d9e76c33143676eef82bab7a49ac1839"
-    )
-    assert readback["production_image_tag_sha"] == (
-        "a70c6756d9e76c33143676eef82bab7a49ac1839"
-    )
+    assert readback["production_image_tag_sha"] == _COMMITTED_SNAPSHOT_SHA
     assert (
         readback["runtime_build_matches_committed_source_control_readback"]
         is False
@@ -32,23 +31,21 @@ def test_production_deploy_readback_uses_runtime_build_commit(monkeypatch):
     assert readback["runtime_build_readback_status"] == (
         "runtime_build_diverges_from_committed_deploy_readback"
     )
-    assert readback["production_image_tag_matches_main"] is False
-    assert payload["status"] == "runtime_build_readback_stale"
-    assert rollups["source_control_main_ready"] is False
-    assert rollups["production_image_tag_matches_main"] is False
-    assert rollups["hard_blocker_count"] == 1
-    assert payload["blockers"] == [
-        "runtime_build_commit_sha_does_not_match_committed_production_readback"
-    ]
+    assert readback["desired_main_api_image_tag_sha"] == build_sha
+    assert readback["desired_main_api_image_tag_source"] == "gitops_deployment_env"
+    assert readback["desired_main_api_image_tag_readback_status"] == "ok"
+    assert readback["production_image_tag_matches_main"] is True
+    assert payload["status"] == "closure_verified"
+    assert rollups["production_image_tag_matches_main"] is True
+    assert rollups["hard_blocker_count"] == 0
 
 
-def test_production_deploy_readback_keeps_closure_when_runtime_matches_snapshot(
-    monkeypatch,
-):
-    build_sha = "a70c6756d9e76c33143676eef82bab7a49ac1839"
+def test_production_deploy_readback_keeps_committed_snapshot_evidence(monkeypatch):
+    build_sha = _COMMITTED_SNAPSHOT_SHA
     monkeypatch.setenv("AWOOOI_BUILD_COMMIT_SHA", build_sha)
+    monkeypatch.setenv("AWOOOI_DESIRED_API_IMAGE_TAG", build_sha)
 
-    payload = load_latest_awoooi_production_deploy_readback_blocker()
+    payload = service.load_latest_awoooi_production_deploy_readback_blocker()
     readback = payload["readback"]
     rollups = payload["rollups"]
 
@@ -58,19 +55,60 @@ def test_production_deploy_readback_keeps_closure_when_runtime_matches_snapshot(
     assert readback["runtime_build_readback_status"] == (
         "matches_committed_deploy_readback"
     )
+    assert readback["desired_main_api_image_tag_sha"] == build_sha
     assert readback["production_image_tag_matches_main"] is True
     assert payload["status"] == "closure_verified"
     assert rollups["production_image_tag_matches_main"] is True
     assert rollups["hard_blocker_count"] == 0
 
 
+def test_production_deploy_readback_blocks_runtime_build_mismatch(monkeypatch):
+    build_sha = "0123456789abcdef0123456789abcdef01234567"
+    desired_sha = "abcdef0123456789abcdef0123456789abcdef01"
+    monkeypatch.setenv("AWOOOI_BUILD_COMMIT_SHA", build_sha)
+    monkeypatch.setenv("AWOOOI_DESIRED_API_IMAGE_TAG", desired_sha)
+
+    payload = service.load_latest_awoooi_production_deploy_readback_blocker()
+    readback = payload["readback"]
+    rollups = payload["rollups"]
+
+    assert payload["status"] == "blocked_production_runtime_image_tag_not_verified"
+    assert readback["runtime_build_commit_sha"] == build_sha
+    assert readback["runtime_build_readback_status"] == (
+        "runtime_build_diverges_from_committed_deploy_readback"
+    )
+    assert readback["desired_main_api_image_tag_sha"] == desired_sha
+    assert readback["production_image_tag_matches_main"] is False
+    assert rollups["source_control_main_ready"] is True
+    assert rollups["production_image_tag_matches_main"] is False
+    assert rollups["hard_blocker_count"] == 1
+    assert "production_runtime_image_tag_does_not_match_gitea_main_desired_tag" in (
+        payload["blockers"]
+    )
+
+
+def test_production_deploy_readback_blocks_unavailable_gitops_desired(monkeypatch):
+    build_sha = "0123456789abcdef0123456789abcdef01234567"
+    monkeypatch.setenv("AWOOOI_BUILD_COMMIT_SHA", build_sha)
+    monkeypatch.delenv("AWOOOI_DESIRED_API_IMAGE_TAG", raising=False)
+
+    payload = service.load_latest_awoooi_production_deploy_readback_blocker()
+    readback = payload["readback"]
+
+    assert payload["status"] == "blocked_production_runtime_image_tag_not_verified"
+    assert readback["desired_main_api_image_tag_readback_status"] == "unavailable"
+    assert readback["production_image_tag_matches_main"] is False
+    assert payload["rollups"]["source_control_main_ready"] is False
+    assert "gitea_main_desired_api_image_tag_readback_unavailable" in payload[
+        "blockers"
+    ]
+
+
 def test_production_deploy_readback_ignores_non_sha_runtime_value(monkeypatch):
     monkeypatch.setenv("AWOOOI_BUILD_COMMIT_SHA", "none")
 
-    payload = load_latest_awoooi_production_deploy_readback_blocker()
+    payload = service.load_latest_awoooi_production_deploy_readback_blocker()
     readback = payload["readback"]
 
     assert "runtime_build_commit_sha" not in readback
-    assert readback["production_image_tag_sha"] == (
-        "a70c6756d9e76c33143676eef82bab7a49ac1839"
-    )
+    assert readback["production_image_tag_sha"] == _COMMITTED_SNAPSHOT_SHA