ci(workers): smoke-test worker image boots before promoting to :latest

[therealbrad]

Description

Adds a smoke-test step to every workers Docker image build so a broken require graph can't silently ship again.

Background. On 2026-04-22 the multitenant-workers deploy crashlooped at startup with Error: Cannot find module 'next/headers'. The bug was a module import that was fine in the Next.js server image but unresolvable in the workers image (Next.js is intentionally stripped to save ~900MB — see Dockerfile deps-workers stage). docker build compiles files but never executes the entrypoints, so CI stayed green and the failure only surfaced at kubectl rollout. This PR closes that gap.

Changes

• New testplanit/scripts/smoke-test-workers.js — CJS script that require()s each compiled worker entry plus dist/scheduler.js. Any require-time error (missing module, unreachable native dep, bundler-stripped package) throws synchronously and the script fails with a clear message. After the loop it calls process.exit(0) to short-circuit the async startWorker() side-effects that fire from the typeof import.meta === "undefined" branch of each worker's main-guard — this is why CI doesn't need live Valkey/Postgres to run the probe.
• Modified .github/workflows/release.yml — one new step per build job, run right after docker buildx bake --push:
  • build-amd64 + build-arm64 (tag-push)
  • docker-manual-amd64 + docker-manual-arm64 (manual dispatch)
  • Pulls the image we just pushed, then runs docker run --rm --entrypoint node <image> ./scripts/smoke-test-workers.js.
  • A failure blocks the per-arch job, which blocks merge-manifests, which is what retags :latest-workers. A broken image can't promote to the floating tag.

The smoke script ships inside the workers image already (COPY --from=build /app/scripts ./scripts at Dockerfile:329), so no Dockerfile changes are needed.

Related Issue

Follow-up to hotfix c804cac (workers crashloop 2026-04-22 16:30 UTC). Companion to #235 (the architectural fix for that incident).

Type of Change

• Bug fix (non-breaking change that fixes an issue)

The fix is a CI-only guardrail; runtime behavior is unchanged.

How Has This Been Tested?

• Unit tests
• Integration tests
• E2E tests
• Manual testing

Built workers locally (pnpm build:workers) and ran the smoke script against the real compiled dist/:

$ node testplanit/scripts/smoke-test-workers.js
✓ notificationWorker
✓ emailWorker
✓ forecastWorker
✓ syncWorker
✓ testmoImportWorker
✓ elasticsearchReindexWorker
✓ auditLogWorker
✓ autoTagWorker
✓ budgetAlertWorker
✓ repoCacheWorker
✓ copyMoveWorker
✓ duplicateScanWorker
✓ magicSelectWorker
✓ stepSequenceScanWorker
✓ generateFromUrlWorker
✓ scheduler

All 16 worker entrypoints loaded successfully.
$ echo $?
0

Verified the failure path by injecting a missing require("definitely-not-a-real-module") into one compiled worker:

✗ auditLogWorker: Cannot find module 'definitely-not-a-real-module'
Require stack:
- .../dist/workers/auditLogWorker.js
- .../scripts/smoke-test-workers.js

1 worker entrypoint(s) failed to load.
$ echo $?
1

That is the exact failure shape that would have caught the next/headers incident.

Test Configuration:

• OS: macOS (Darwin 25.4.0, ARM)
• Node version: v24.14.0 (matches Dockerfile FROM node:24-alpine)

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published
• I have signed the CLA

Additional Notes

Maintenance contract. When adding a new worker, update three files (existing convention, per CLAUDE memory):

• scripts/build-workers.js — add to entryPoints
• ecosystem.config.js — add to PM2 apps
• package.json — add worker:<name> script + include in workers concurrently list

This PR adds a fourth:

• scripts/smoke-test-workers.js — add to WORKERS array

A comment in the new file points at ecosystem.config.js + scripts/build-workers.js as the two lists that must stay in sync. It's explicit rather than metaprogrammed on purpose: a smoke test that silently skips a new worker would defeat its own purpose.

Why require() instead of the one-liner in the post-mortem. The user-suggested docker run --entrypoint node <image> -e "require('./dist/workers/testmoImportWorker.js')" would hang: workers use a main-guard (typeof import.meta === "undefined" branch fires under Node's CJS loader) that kicks off BullMQ's background Valkey connection. Without process.exit(0) after the require, the Node event loop stays busy until the Valkey connection errors after its timeout — slow, and the failure mode is noisy and easy to misread. The script wraps every require in a try/catch, force-exits cleanly, and gives one pass/fail line per worker — much easier to read in a CI log.

Scope. This PR is CI/test-only. It does not change worker runtime, does not change Dockerfile stages, and does not change what images are tagged where. PR 3 (next) addresses the floating-tag problem that made rollback impossible during the incident.

[therealbrad]

🎉 This PR is included in version 0.22.8 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀