Complete Doppler integration end to end

.dockerignore

@@ -0,0 +1,27 @@
+.git
+.github
+.venv
+venv
+env
+__pycache__
+*.py[cod]
+.pytest_cache
+.ruff_cache
+.mypy_cache
+.coverage
+coverage.xml
+htmlcov
+*.egg-info
+build
+dist
+ci-test.db
+fluxqueue.db
+*.log
+.env
+.env.*
+!.env.example
+tests
+scripts
+docs
+deploy
+docker-compose.override.yml

.env.example

@@ -11,5 +11,11 @@ LOG_LEVEL=INFO
 API_KEY=
 API_KEYS={}
 MAX_ACTIVE_JOBS_PER_TENANT=1000
+# Managed PostgreSQL only: use verify-full or verify-ca in production and provision the CA file
+# through the deployment environment. Never commit certificates or keys.
+# DATABASE_SSLMODE=verify-full
+# DATABASE_SSLROOTCERT=/run/secrets/postgres-ca.crt
+# DATABASE_SSLCERT=/run/secrets/postgres-client.crt
+# DATABASE_SSLKEY=/run/secrets/postgres-client.key
 # Example production mapping (store real keys only in Doppler or another secret manager):
 # API_KEYS={"replace-with-a-long-random-secret":"tenant-a"}

.github/workflows/ci.yml

@@ -24,8 +24,8 @@ jobs:
     env:
       DATABASE_URL: sqlite:///./ci-test.db
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -44,7 +44,7 @@ jobs:
         run: pytest --cov=fluxqueue --cov-report=xml --junitxml=junit.xml
       - name: Archive test and coverage reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: fluxqueue-test-reports
           path: |
@@ -54,6 +54,8 @@ jobs:
           retention-days: 14
       - name: Validate Docker Compose configuration
         run: docker compose config --quiet
+      - name: Validate Doppler-to-service environment wiring
+        run: python scripts/validate_doppler_config.py
       - name: Build container image
         run: docker build --tag fluxqueue-ci .
       - name: Verify container runs as non-root
@@ -84,12 +86,26 @@ jobs:
           test "$(curl --silent --output /dev/null --write-out '%{http_code}' \
             --header 'Authorization: Bearer ci-smoke-test-key' \
             http://127.0.0.1:8000/api/v1/jobs)" = "200"
+      - name: Validate example Nginx configuration
+        shell: bash
+        run: |
+          set -euo pipefail
+          cert_dir="$(mktemp -d)"
+          trap 'rm -rf "$cert_dir"' EXIT
+          openssl req -x509 -nodes -newkey rsa:2048 -days 1 \
+            -keyout "$cert_dir/privkey.pem" \
+            -out "$cert_dir/fullchain.pem" \
+            -subj "/CN=fluxqueue.example.com" >/dev/null 2>&1
+          docker run --rm \
+            --volume "$PWD/deploy/nginx/fluxqueue.conf.example:/etc/nginx/conf.d/fluxqueue.conf:ro" \
+            --volume "$cert_dir:/etc/letsencrypt/live/fluxqueue.example.com:ro" \
+            nginx:alpine nginx -t
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5
         with:
           files: coverage.xml
           token: ${{ secrets.CODECOV_TOKEN }}
-          fail_ci_if_error: false
+          fail_ci_if_error: true
 
   postgres-integration:
     runs-on: ubuntu-latest
@@ -111,8 +127,8 @@ jobs:
       DATABASE_URL: postgresql+psycopg://fluxqueue:fluxqueue@localhost:5432/fluxqueue
       FLUXQUEUE_POSTGRES_TEST_URL: postgresql+psycopg://fluxqueue:fluxqueue@localhost:5432/fluxqueue
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -123,7 +139,7 @@ jobs:
         run: pytest -q tests/test_postgres_integration.py --junitxml=postgres-junit.xml
       - name: Archive PostgreSQL integration report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: fluxqueue-postgres-integration-report
           path: postgres-junit.xml
@@ -133,8 +149,8 @@ jobs:
   dependency-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -150,20 +166,18 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: github/codeql-action/init@v3
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
         with:
           languages: python
           queries: security-extended
-      # Keep CI usable when GitHub code scanning is not enabled for this repository.
-      # SARIF is retained as an artifact; enabling code scanning allows upload to Security alerts.
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@v4
         with:
-          upload: false
+          upload: true
           output: results
       - name: Archive CodeQL SARIF results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: fluxqueue-codeql-sarif
           path: results/*.sarif

.github/workflows/deployment-smoke.yml

@@ -0,0 +1,70 @@
+name: Deployment smoke test
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fluxqueue-deployment-smoke
+  cancel-in-progress: false
+
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 8
+    env:
+      BASE_URL: https://fluxqueue-api.onrender.com
+      API_KEY: ${{ secrets.FLUXQUEUE_API_KEY }}
+    steps:
+      - name: Validate required secret
+        shell: bash
+        run: |
+          if [[ -z "$API_KEY" ]]; then
+            echo "::error::Add repository Actions secret FLUXQUEUE_API_KEY using the active FluxQueue tenant API key."
+            exit 1
+          fi
+
+      - name: Check API liveness and database readiness
+        shell: bash
+        run: |
+          set -euo pipefail
+          curl --fail --silent --show-error --retry 3 --retry-delay 5 "$BASE_URL/health/live"
+          echo
+          curl --fail --silent --show-error --retry 3 --retry-delay 5 "$BASE_URL/health/ready"
+          echo
+
+      - name: Submit and verify a real job lifecycle
+        shell: bash
+        run: |
+          set -euo pipefail
+          marker="deployment-smoke-$(date +%s)"
+          payload="$(jq -nc --arg marker "$marker" '{task_type:"echo",payload:{message:$marker},queue:"deployment-smoke",priority:5,max_attempts:2}')"
+          response="$(curl --fail --silent --show-error -X POST "$BASE_URL/api/v1/jobs" \
+            -H "Authorization: Bearer $API_KEY" \
+            -H 'Content-Type: application/json' \
+            -H "Idempotency-Key: $marker" \
+            --data "$payload")"
+          job_id="$(jq -er '.id' <<<"$response")"
+          echo "Submitted job id: $job_id"
+          for attempt in $(seq 1 30); do
+            current="$(curl --fail --silent --show-error "$BASE_URL/api/v1/jobs/$job_id" \
+              -H "Authorization: Bearer $API_KEY")"
+            status="$(jq -r '.status' <<<"$current")"
+            echo "Poll $attempt: status=$status"
+            if [[ "$status" == "succeeded" ]]; then
+              jq -e --arg marker "$marker" '.result_json.payload.message == $marker' <<<"$current" >/dev/null
+              echo "End-to-end job processing passed."
+              exit 0
+            fi
+            if [[ "$status" == "dead" || "$status" == "cancelled" ]]; then
+              echo "::error::Smoke job reached terminal status $status"
+              jq '{id,status,last_error}' <<<"$current"
+              exit 1
+            fi
+            sleep 2
+          done
+          echo "::error::Job did not succeed within 60 seconds."
+          jq '{id,status,last_error}' <<<"$current"
+          exit 1

Dockerfile

@@ -7,4 +7,4 @@ COPY src ./src
 RUN pip install --no-cache-dir .
 USER 10001:10001
 EXPOSE 8000
-CMD ["sh", "-c", "alembic upgrade head && exec uvicorn fluxqueue.main:app --host 0.0.0.0 --port 8000"]
+CMD ["sh", "-c", "alembic upgrade head && if [ \"${RUN_WORKER:-false}\" = \"true\" ]; then python -m fluxqueue.worker & fi; exec uvicorn fluxqueue.main:app --host 0.0.0.0 --port \"${PORT:-8000}\""]