feat(safety): probe browser that clicks, and sibling links in the bundle

.github/workflows/deploy.yml

@@ -78,6 +78,29 @@ jobs:
           cache-to: type=gha,mode=max
           platforms: linux/amd64
 
+      # The safety tier's probe browser ships beside the app under the same
+      # tags, so one IMAGE_TAG names a working pair.
+      - name: Extract metadata (browser)
+        id: meta_browser
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-browser
+          tags: |
+            type=semver,pattern={{version}}
+            type=sha,prefix=,format=short
+            type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+
+      - name: Build and push (browser)
+        uses: docker/build-push-action@v7
+        with:
+          context: browser
+          push: true
+          tags: ${{ steps.meta_browser.outputs.tags }}
+          labels: ${{ steps.meta_browser.outputs.labels }}
+          cache-from: type=gha,scope=browser
+          cache-to: type=gha,mode=max,scope=browser
+          platforms: linux/amd64
+
   deploy:
     needs: build
     # run when build succeeded OR was skipped (rollback path)
@@ -125,7 +148,10 @@ jobs:
             }
 
             set_tag "${IMAGE_TAG}"
-            docker compose --env-file .env -f docker-compose.prod.yml pull app
+            docker compose --env-file .env -f docker-compose.prod.yml pull app browser
+            # The probe browser is stateless and health-gated by the worker's
+            # fallback to Cloudflare snapshots, so it swaps first, ungated.
+            docker compose --env-file .env -f docker-compose.prod.yml up -d --no-deps browser
             docker compose --env-file .env -f docker-compose.prod.yml up -d --no-deps app
 
             if ! wait_healthy spoo_app; then

.github/workflows/image.yml

@@ -74,3 +74,25 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: linux/amd64
+
+      # The safety tier's probe browser ships beside the app under the same
+      # tags, so one IMAGE_TAG names a working pair.
+      - name: Extract metadata (browser)
+        id: meta_browser
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-browser
+          tags: |
+            type=raw,value=edge,enable=${{ github.event_name == 'push' }}
+            type=sha,prefix=,format=short
+
+      - name: Build and push (browser)
+        uses: docker/build-push-action@v7
+        with:
+          context: browser
+          push: true
+          tags: ${{ steps.meta_browser.outputs.tags }}
+          labels: ${{ steps.meta_browser.outputs.labels }}
+          cache-from: type=gha,scope=browser
+          cache-to: type=gha,mode=max,scope=browser
+          platforms: linux/amd64

browser/Dockerfile

@@ -0,0 +1,10 @@
+FROM mcr.microsoft.com/playwright/python:v1.62.0-noble
+
+RUN pip install --no-cache-dir playwright==1.62.0 starlette==1.6.0 uvicorn==0.52.4
+
+WORKDIR /srv
+COPY probe.py /srv/probe.py
+
+USER pwuser
+EXPOSE 8011
+CMD ["uvicorn", "probe:app", "--host", "0.0.0.0", "--port", "8011", "--no-access-log"]