Post-deployment smoke tests automated or documented; key user flows verified after every production deployment

A deployment that succeeds at the infrastructure level can still break login, payment processing, or core data flows — the CI/CD pipeline passes, but users hit errors. Without automated post-deployment smoke tests (NIST SA-11, SSDF PW.8), the first signal of a broken deployment is a user support ticket. ISO 25010 reliability.maturity requires that production changes be verified as correct after deployment, not just before it. A 3-minute automated smoke test covering the critical user journey is the difference between a 5-minute rollback and a 45-minute incident.

Add automated post-deployment smoke tests using Playwright. Run them immediately after the production deployment step in CI/CD.

npm install --save-dev @playwright/test

// tests/smoke.spec.ts
import { test, expect } from '@playwright/test';

test('homepage loads', async ({ page }) => {
  await page.goto(process.env.BASE_URL!);
  await expect(page).toHaveTitle(/my app/i);
});

test('login flow completes', async ({ page }) => {
  await page.goto(`${process.env.BASE_URL}/login`);
  await page.fill('[name=email]', process.env.SMOKE_TEST_EMAIL!);
  await page.fill('[name=password]', process.env.SMOKE_TEST_PASSWORD!);
  await page.click('[type=submit]');
  await expect(page).toHaveURL(/\/dashboard/);
});

# .github/workflows/deploy.yml
- name: Deploy to production
  run: npm run deploy:prod

- name: Run smoke tests
  run: npx playwright test tests/smoke.spec.ts
  env:
    BASE_URL: https://your-app.com
    SMOKE_TEST_EMAIL: ${{ secrets.SMOKE_TEST_EMAIL }}
    SMOKE_TEST_PASSWORD: ${{ secrets.SMOKE_TEST_PASSWORD }}