From c36a24039465a2701f0c8eb722e02f2db17b9fa2 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Tue, 10 Feb 2026 01:16:17 -0500
Subject: [PATCH] Add cache-safe deploy smoke checks for unstable releases

---
 .github/workflows/ci.yml              | 12 ++++--
 docs/qa.md                            |  6 +++
 package.json                          |  4 +-
 tests/e2e/cache-upgrade-smoke.spec.ts | 56 +++++++++++++++++++++++++++
 4 files changed, 74 insertions(+), 4 deletions(-)
 create mode 100644 tests/e2e/cache-upgrade-smoke.spec.ts

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e3253736..77f31e56 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -58,6 +58,15 @@ jobs:
       - name: Build assets
         run: npm run build
 
+      - name: Smoke check hashed dist asset references
+        run: npm run smoke:dist-assets
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium
+
+      - name: Run cache-upgrade smoke test
+        if: github.event_name == 'push' && github.ref == 'refs/heads/unstable'
+        run: npm run test:e2e:cache-upgrade
 
       - name: Generate dist hash state
         if: github.event_name == 'push' && github.ref == 'refs/heads/unstable'
@@ -73,9 +82,6 @@ jobs:
           path: artifacts/dist-hashes-current.json
           if-no-files-found: error
 
-      - name: Install Playwright browsers
-        run: npx playwright install --with-deps chromium
-
       - name: Run visual regression tests
         id: visual
         run: npm run test:visual
diff --git a/docs/qa.md b/docs/qa.md
index f46a7b70..45f4d2a8 100644
--- a/docs/qa.md
+++ b/docs/qa.md
@@ -50,4 +50,10 @@ Automated regression coverage now exercises these flows on the unified design-sy
    - While still signed in via the direct-key provider, send a direct message to a second account and confirm it decrypts successfully on the recipient before release.
    - Log out and ensure the session clears decrypted key material; stored keys should require the passphrase to unlock again.
 
+9. **Cache-Safe Deploy Checklist**
+   - Build from a clean tree (`npm run build`) and inspect `dist/index.html` and `dist/embed.html`; confirm every local JS/CSS `<script src>` / `<link href>` reference points at a hashed file name (for example `app.<hash>.js`) instead of unhashed paths.
+   - Confirm entry HTML responses use revalidation-friendly cache headers (`Cache-Control: no-cache` or equivalent) so browsers revalidate HTML on navigation/reload.
+   - With an already-open page, deploy a new build and reload once. Confirm the service worker transitions to the newest version (new worker reaches `activated` and controls the client) without forcing users to hard refresh.
+   - Perform a rollback deploy to the prior build and reload normally. Confirm the app loads the rolled-back bundle version without requiring cache clear or hard refresh.
+
 Document findings (pass/fail notes plus relevant screenshots or logs) so they can be attached to release or PR notes.
diff --git a/package.json b/package.json
index 0d18dcc3..28d20582 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,9 @@
     "lint:sw-compat": "node scripts/check-sw-compat.mjs",
     "hash:dist": "node scripts/hash-dist.mjs --dist dist --output artifacts/dist-hashes-current.json",
     "diff:dist-hashes": "node scripts/diff-dist-hashes.mjs",
-    "purge:cloudflare:changed": "node scripts/purge-cloudflare-changed.mjs"
+    "purge:cloudflare:changed": "node scripts/purge-cloudflare-changed.mjs",
+    "smoke:dist-assets": "node scripts/check-asset-references.mjs",
+    "test:e2e:cache-upgrade": "npx playwright test tests/e2e/cache-upgrade-smoke.spec.ts --project=e2e"
   },
   "devDependencies": {
     "@playwright/test": "^1.58.2",
diff --git a/tests/e2e/cache-upgrade-smoke.spec.ts b/tests/e2e/cache-upgrade-smoke.spec.ts
new file mode 100644
index 00000000..0162bd74
--- /dev/null
+++ b/tests/e2e/cache-upgrade-smoke.spec.ts
@@ -0,0 +1,56 @@
+import { expect, test } from "@playwright/test";
+
+test("reload after deploy upgrade picks latest hashed bundle without manual cache clear", async ({
+  page,
+}) => {
+  let activeVersion = "v1";
+
+  await page.route("**/cache-upgrade-smoke/index.html", async (route) => {
+    const html = `<!doctype html>
+<html>
+  <head>
+    <meta charset=\"utf-8\" />
+    <title>Cache Upgrade Smoke</title>
+    <script src=\"/cache-upgrade-smoke/app.${activeVersion}.js\"></script>
+  </head>
+  <body>
+    <div id=\"app\">cache-upgrade-smoke</div>
+  </body>
+</html>`;
+
+    await route.fulfill({
+      status: 200,
+      contentType: "text/html",
+      headers: {
+        "cache-control": "no-cache",
+      },
+      body: html,
+    });
+  });
+
+  await page.route("**/cache-upgrade-smoke/app.*.js", async (route) => {
+    const requestUrl = new URL(route.request().url());
+    const filename = requestUrl.pathname.split("/").pop() ?? "";
+
+    await route.fulfill({
+      status: 200,
+      contentType: "application/javascript",
+      headers: {
+        "cache-control": "public, max-age=31536000, immutable",
+      },
+      body: `window.__cacheUpgradeBundle = ${JSON.stringify(filename)};`,
+    });
+  });
+
+  await page.goto("/cache-upgrade-smoke/index.html");
+  await expect
+    .poll(() => page.evaluate(() => (window as any).__cacheUpgradeBundle))
+    .toBe("app.v1.js");
+
+  activeVersion = "v2";
+
+  await page.reload();
+  await expect
+    .poll(() => page.evaluate(() => (window as any).__cacheUpgradeBundle))
+    .toBe("app.v2.js");
+});