Authorize deployed read-only smoke

Refs #75

Author: alexeygrigorev

.github/workflows/ci.yml

@@ -1303,6 +1303,9 @@ jobs:
           PROJECT_TAG: ${{ vars.DEVELOPMENT_RESOURCE_PROJECT_TAG }}
           ENVIRONMENT_TAG: ${{ vars.DEVELOPMENT_RESOURCE_ENVIRONMENT_TAG }}
           FAILURE_INJECTION: ${{ github.event_name == 'push' && 'none' || inputs.failure_injection }}
+          DTC_TEST_SAFETY_COMMAND: remote_readonly
+          DTC_TEST_TARGET_CLASS: isolated_development
+          DTC_TEST_REMOTE_NAMESPACE: deploy-${{ github.run_id }}-${{ github.run_attempt }}
         run: |
           set -euo pipefail
           mkdir -p .tmp/deployment .tmp/deployed-smoke

ci/tests/test_workflows.py

@@ -99,6 +99,26 @@ def test_aggregate_gate_is_the_release_dependency() -> None:
     assert "release-image-" in str(jobs["container"])
 
 
+def test_deploy_smoke_has_exact_readonly_authority_and_pinned_base_url() -> None:
+    deploy = workflow("ci.yml")["jobs"]["deploy"]
+    release = next(step for step in deploy["steps"] if step.get("id") == "release")
+
+    assert {
+        name: release["env"][name]
+        for name in (
+            "DTC_TEST_SAFETY_COMMAND",
+            "DTC_TEST_TARGET_CLASS",
+            "DTC_TEST_REMOTE_NAMESPACE",
+        )
+    } == {
+        "DTC_TEST_SAFETY_COMMAND": "remote_readonly",
+        "DTC_TEST_TARGET_CLASS": "isolated_development",
+        "DTC_TEST_REMOTE_NAMESPACE": "deploy-${{ github.run_id }}-${{ github.run_attempt }}",
+    }
+    assert "DTC_TEST_BASE_URL" not in release["env"]
+    assert "--base-url https://web.dtcdev.click" in release["run"]
+
+
 def test_manual_release_is_full_and_probe_contract_stays_separate() -> None:
     jobs = workflow("ci.yml")["jobs"]
     assert "manual_dispatch" in (ROOT / "ci" / "classifier.py").read_text(encoding="utf-8")

core/tests/test_web_runtime_coherence.py

@@ -21,6 +21,7 @@
     WebRuntimeBinding,
 )
 from deploy.legacy_development_compatibility import ECR_REPOSITORY_URI
+from test_support.safety import authorize_from_environment
 
 SOURCE_SHA = "a" * 40
 IMAGE_DIGEST = f"sha256:{'b' * 64}"
@@ -317,6 +318,9 @@ def collect_subprocess(
             "VERSION": VERSION,
             "IMAGE_DIGEST": IMAGE_DIGEST,
             "RELEASE_SHA": SOURCE_SHA,
+            "DTC_TEST_SAFETY_COMMAND": "remote_readonly",
+            "DTC_TEST_TARGET_CLASS": "isolated_development",
+            "DTC_TEST_REMOTE_NAMESPACE": "deploy-12345678-1",
         }
         with (
             patch.dict("os.environ", workflow_environment, clear=True),
@@ -336,6 +340,13 @@ def collect_subprocess(
         self.assertEqual(environment["DTC_EXPECTED_VERSION"], VERSION)
         self.assertEqual(environment["DTC_EXPECTED_SOURCE_SHA"], SOURCE_SHA)
         self.assertEqual(environment["DTC_EXPECTED_IMAGE_DIGEST"], IMAGE_DIGEST)
+        self.assertEqual(environment["DTC_TEST_SAFETY_COMMAND"], "remote_readonly")
+        self.assertEqual(environment["DTC_TEST_TARGET_CLASS"], "isolated_development")
+        self.assertEqual(environment["DTC_TEST_REMOTE_NAMESPACE"], "deploy-12345678-1")
+        self.assertEqual(environment["DTC_TEST_BASE_URL"], "https://web.dtcdev.click")
+        with patch.dict("os.environ", environment, clear=True):
+            authorization = authorize_from_environment("remote_readonly")
+        self.assertEqual(authorization.base_url, "https://web.dtcdev.click")
 
     def test_eventual_visibility_freezes_two_samples_around_public_health(self) -> None:
         events: list[str] = []