test(auth): pin the browser session contract, and gate the deploy

.github/workflows/deploy.ymlmodified+24-0

Changes to .github/workflows/deploy.yml

		⋯47 linesShow the 47 lines above this hunk@@ -48,6 +48,22 @@ jobs:
48	48	- name: Install dependencies
49	49	run: bun install --frozen-lockfile
50	50
	51	+ # The suite runs here, not as a `needs:` on the CI workflow: `needs:`
	52	+ # only reaches jobs in the same file, and lint/typecheck/test live in
	53	+ # ci.yml. Without this, a push whose tests fail still deploys - as
	54	+ # aac396460 did on 2026-09-24, where CI's test job failed and this
	55	+ # workflow succeeded on the same sha, in the same minute. The whole
	56	+ # suite costs a few seconds, so gating here is cheaper than a
	57	+ # workflow_run indirection.
	58	+ - name: Lint
	59	+ run: ./buddy lint
	60	+
	61	+ - name: Typecheck
	62	+ run: ./buddy typecheck
	63	+
	64	+ - name: Test
	65	+ run: bun run test
	66	+
51	67	- name: Build the production artifact
52	68	run: bun run build
53	69
		⋯35 linesShow the 35 lines above this hunk@@ -89,6 +105,14 @@ jobs:
89	105	DOTENV_PRIVATE_KEY_PRODUCTION: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}
90	106	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
91	107
	108	+ # SMOKE_EMAIL / SMOKE_PASSWORD turn on the sign-in leg: a real POST /login
	109	+ # followed by an authenticated GET /api/v1/workspace. Without them the
	110	+ # script still runs and says it skipped that leg, so this step does not
	111	+ # fail before the secrets exist. The account must belong to a team and
	112	+ # must not have two-factor enabled.
92	113	- name: Smoke test production
93	114	if: github.event_name == 'push' || github.event.inputs.dry_run == 'false'
94	115	run: bun run deployment:smoke
	116	+ env:
	117	+ SMOKE_EMAIL: ${{ secrets.SMOKE_EMAIL }}
	118	+ SMOKE_PASSWORD: ${{ secrets.SMOKE_PASSWORD }}