# Релиз и QA gates

Перед production не «авось прокатит», а чеклист из ТЗ §17. Если что-то красное — сначала staging, потом prod. Живёт один раз.

## Pipeline

```mermaid
flowchart TD
  CI[CI green] --> ST[Staging + TLS]
  ST --> E2E[E2E 11/11]
  ST --> K6[k6 pass]
  ST --> ZAP[ZAP 0 High/Crit]
  ST --> LH[Lighthouse ≥ 85]
  E2E --> PROD[Production deploy]
  K6 --> PROD
  ZAP --> PROD
  LH --> PROD
  PROD --> SM[smoke-prod.sh]
  SM --> DNS[DNS cutover]
  DNS --> MON[24h мониторинг]
```

## Регрессия E2E

**Последний локальный прогон:** 2026-07-14 — backend 137 / 90.43% cov, frontend 46.

### Staging

```bash
E2E_BASE_URL=https://staging.example.com E2E_START_API=false pnpm --filter web e2e
```

| # | Сценарий | Local | Staging |
|---|----------|:-----:|:-------:|
| 1 | Landing hero, reduced-motion | ☐ | ☐ |
| 2 | Register → verify → login → profile → logout | ☐ | ☐ |
| 3 | Forgot → reset → login | ☐ | ☐ |
| 4 | Admin publish → public slug | ☐ | ☐ |
| 5 | Block user → login denied | ☐ | ☐ |
| 6 | Pending → нет `/profile` | ☐ | ☐ |
| 7 | Refresh rotation | ☐ | ☐ |
| 8 | IDOR user A ≠ user B | ☐ | ☐ |
| 9 | Admin не блокирует себя / last admin | ☐ | ☐ |
| 10 | Avatar: bad MIME / size / SVG | ☐ | ☐ |
| 11 | Block → access JWT 401 TOKEN_REVOKED | ☐ | ☐ |

### Локально

```bash
pnpm --filter web e2e    # API :8001, Vite :5175
```

## k6 (§17.2)

```bash
k6 run infra/k6/mvp-load-test.js -e BASE_URL=https://staging.example.com
```

| Параметр | Порог |
|----------|-------|
| VU / ramp | 50 / 5 min |
| Mix | 35% list, 25% login, 20% me, 10% refresh, 10% slug |
| p95 | < 300 ms |
| Errors | < 1% |

## OWASP ZAP

```bash
docker run --rm -v "$(pwd):/zap/wrk:rw" -t ghcr.io/zap/zaproxy:stable \
  zap-baseline.py -t https://staging.example.com -r zap-report.html
```

| Severity | Pass |
|----------|------|
| High, Critical | **0** |

Medium/Low — review руками. `zap-report.html` — в архив релиза.

## Lighthouse

```bash
npx lighthouse https://staging.example.com \
  --preset=mobile --only-categories=performance \
  --output=json --output-path=./lighthouse-report.json
```

| Метрика | ≥ |
|---------|---|
| Performance (mobile, `/`) | 85 |

Не прошло — hero video `preload="none"`, font swap, меньше JS на лендинге.

## Release gates (сводка)

- [ ] CI green на `main`
- [ ] E2E 11/11 на staging
- [ ] k6 pass
- [ ] ZAP 0 High/Critical
- [ ] Lighthouse ≥ 85
- [ ] [security.md](./security.md) staging-пункты
- [ ] `./infra/scripts/smoke-prod.sh` на prod
- [ ] DNS cutover + rollback plan (previous tag)

## CI локально

```bash
pnpm lint && pnpm typecheck
cd apps/api && python -m mypy app
pnpm --filter web test:ci
cd apps/api && python -m pytest --cov=app --cov-fail-under=90
```

Полный pipeline: `.github/workflows/ci.yml`.