From 1f736b2da9c815cabac36e4b76883ef8a6b1a5cf Mon Sep 17 00:00:00 2001
From: "Kai (Tam Nhu) Tran" <61256810+kaitranntt@users.noreply.github.com>
Date: Sun, 17 May 2026 05:26:42 -0400
Subject: [PATCH] fix(ci): smoke-test failure check + relax service-key guard
 (REV9, REV10) (#1276)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

REV9 — docker-release.yml smoke-test: add HEALTHY flag to the boot-and-wait
loop. Previously a timeout (status stays 'starting'/'missing' for all 12
iterations) exited the loop silently, letting port probes be the only net.
Now if the loop exits without HEALTHY=1 the step fails immediately with
container logs and state dump. network-contract.sh already has the HEALTHY
pattern — no change needed there.

REV10 — breaking-change-guard.yml: drop the OLD_KEYS != NEW_KEYS comparison.
That check treated ANY change to the service-key set as breaking — including
adding a harmless sidecar. The DNS contract only requires services.ccs to
exist; other services are irrelevant to the 'ccs' hostname on ccs-net. Keep
only the "ccs key must exist" check; remove the unused OLD_KEYS extraction.
---
 .github/workflows/breaking-change-guard.yml | 17 +++++------------
 .github/workflows/docker-release.yml        |  8 ++++++++
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/breaking-change-guard.yml b/.github/workflows/breaking-change-guard.yml
index 96ebe620..c00ce7b6 100644
--- a/.github/workflows/breaking-change-guard.yml
+++ b/.github/workflows/breaking-change-guard.yml
@@ -81,18 +81,15 @@ jobs:
             BREAKING=1
           fi
 
-          # 4. Service key rename — public DNS contract on ccs-net depends on the
-          #    service key being "ccs". Docker's service-name DNS resolves sibling
-          #    containers via the compose service KEY (e.g. http://ccs:8317). A
-          #    rename from "ccs:" to anything else silently breaks every sibling
-          #    container in the wild even when image/network/container_name match.
+          # 4. Service key contract — Docker DNS on ccs-net uses the compose service
+          #    KEY as the hostname (e.g. http://ccs:8317). Renaming or removing
+          #    "ccs:" breaks every sibling container in the wild. Adding new service
+          #    keys (e.g. a sidecar) does NOT affect the "ccs" DNS contract and is
+          #    therefore allowed without a breaking-change marker.
           #
           #    Extraction logic: find lines that look like top-level service keys
           #    (two-space indent + identifier + colon, NOT sub-keys like "image:").
           #    This matches YAML service keys without requiring an external YAML parser.
-          OLD_KEYS=$(git show "${BASE}:docker/compose.yaml" 2>/dev/null \
-            | awk '/^services:/{s=1;next} s && /^  [a-zA-Z0-9_-]+:/{print $1} /^[^ ]/{s=0}' \
-            | tr -d ':' | sort | tr '\n' ' ' | sed 's/ $//')
           NEW_KEYS=$(awk '/^services:/{s=1;next} s && /^  [a-zA-Z0-9_-]+:/{print $1} /^[^ ]/{s=0}' \
             docker/compose.yaml \
             | tr -d ':' | sort | tr '\n' ' ' | sed 's/ $//')
@@ -100,10 +97,6 @@ jobs:
             echo "[!] BREAKING: services.ccs key missing from docker/compose.yaml — sibling containers on ccs-net rely on DNS hostname 'ccs'"
             BREAKING=1
           fi
-          if [[ "${OLD_KEYS}" != "${NEW_KEYS}" ]]; then
-            echo "[!] BREAKING: services keys changed: '${OLD_KEYS}' -> '${NEW_KEYS}'"
-            BREAKING=1
-          fi
 
           echo "breaking=${BREAKING}" >> "$GITHUB_OUTPUT"
 
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 5061e873..5e02fa60 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -342,10 +342,12 @@ jobs:
             "${{ steps.image.outputs.ref }}"
 
           echo "[i] Waiting for container healthcheck (up to 60s)..."
+          HEALTHY=0
           for i in $(seq 1 12); do
             STATUS=$(docker inspect "${CONTAINER_NAME}" --format='{{.State.Health.Status}}' 2>/dev/null || echo "missing")
             if [[ "${STATUS}" == "healthy" ]]; then
               echo "[OK] Container is healthy after $((i * 5))s"
+              HEALTHY=1
               break
             fi
             if [[ "${STATUS}" == "unhealthy" ]]; then
@@ -356,6 +358,12 @@ jobs:
             echo "    [${i}/12] status=${STATUS}, waiting 5s..."
             sleep 5
           done
+          if [[ "${HEALTHY}" -ne 1 ]]; then
+            echo "[X] Container did not become healthy within 60s (last status: ${STATUS})" >&2
+            docker logs "${CONTAINER_NAME}" --tail 100 >&2
+            docker inspect "${CONTAINER_NAME}" --format='{{json .State}}' >&2 || true
+            exit 1
+          fi
 
       - name: Run network-contract test
         run: |