From 76623d4b6353e7b6235ba2756acb99ca69ef0b9f Mon Sep 17 00:00:00 2001
From: abrichr <richard.abrich@mldsai.com>
Date: Mon, 27 Jul 2026 22:49:09 -0400
Subject: [PATCH] ci: prove the Fly credential without deploying

FLY_API_TOKEN now exists, but Deploy Worker only triggers on a push touching
apps/worker/**. The obvious test -- re-running its last failed run -- would
push commit e99cdbe from 2026-03-19 over a live service that someone deployed
by hand, purely to test a credential.

This reads instead: whoami and status, both read-only. The deploy stays
push-gated and fires on the next real worker change.
---
 .github/workflows/verify-fly-credential.yml | 50 +++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 .github/workflows/verify-fly-credential.yml

diff --git a/.github/workflows/verify-fly-credential.yml b/.github/workflows/verify-fly-credential.yml
new file mode 100644
index 0000000..edc9bfd
--- /dev/null
+++ b/.github/workflows/verify-fly-credential.yml
@@ -0,0 +1,50 @@
+name: Verify Fly credential
+
+# Read-only proof that FLY_API_TOKEN authenticates against the wright-worker
+# app. Deliberately separate from `Deploy Worker`.
+#
+# WHY THIS IS NOT A DISPATCHABLE DEPLOY
+# ------------------------------------
+# `Deploy Worker` triggers only on a push touching apps/worker/**, so the
+# obvious way to test a newly-added token is to re-run its last failed run.
+# That run is commit e99cdbe from 2026-03-19, and wright-worker.fly.dev is
+# currently serving a build someone deployed by hand from a local flyctl.
+# Re-running it would push four-month-old code over a live service to test a
+# credential. Adding workflow_dispatch to the deploy itself has the same
+# hazard, one click further away.
+#
+# So this proves the credential and touches nothing. `flyctl auth whoami` and
+# `flyctl status` read; they do not write. The real deploy stays push-gated and
+# fires on the next genuine change to the worker.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Check the token is present
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
+        run: |
+          if [ -z "${FLY_API_TOKEN}" ]; then
+            echo "::error title=FLY_API_TOKEN missing::The secret is not visible to this job."
+            exit 1
+          fi
+          echo "FLY_API_TOKEN is present (${#FLY_API_TOKEN} characters)."
+
+      - uses: superfly/flyctl-actions/setup-flyctl@master
+
+      - name: Authenticate and read app state (no writes)
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
+        run: |
+          set -euo pipefail
+          echo "--- whoami ---"
+          flyctl auth whoami
+          echo "--- status: wright-worker ---"
+          flyctl status --app wright-worker
+          echo
+          echo "The credential authenticates and can read the app. No deploy ran."