name: Prod test-surface smoke (AC-33)

# Permanent prod smoke: all /api/test/* deny, E2E:+phone bypass dead, /dev/payments absent.
# Extends deploy-prod.sh AC-33 partial (deploy_verify_ac33_test_routes_denied) into a full audit.
# Add the daily `schedule:` trigger as part of prod cutover — PROD_URL has no DNS until then.
on:
  workflow_dispatch:

concurrency:
  group: prod-test-surface-smoke
  cancel-in-progress: false

permissions:
  contents: read

env:
  PROD_URL: https://app.multideal.co.il
  MIN_TEST_ROUTES: 18

jobs:
  audit:
    name: AC-33 test-surface OFF
    runs-on: [self-hosted, linux, x64, multideal-gate]
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7

      - name: Audit prod test surface
        run: node scripts/audit-prod-test-surface.mjs
