From 6aa1cad89f78ed2dee165a124fa044ad3d45ed4e Mon Sep 17 00:00:00 2001 From: Clawdbot Date: Mon, 14 Sep 2026 21:44:40 +0000 Subject: [PATCH] ci: update TESTING.md --- TESTING.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/TESTING.md b/TESTING.md index c2f13aa..4e946f3 100644 --- a/TESTING.md +++ b/TESTING.md @@ -140,6 +140,25 @@ tests\run-tests.cmd http://localhost:8085/run-all.asp - Re-running the suite produces stable results. - The production site under `public/` still exposes no test runner pages or test routes. +## Deployment verification gate + +Before a production release: + +1. Run the full ASPUnit suite in the isolated development IIS application. +2. Parse every repository `web.config` as XML. +3. Parse both deployment scripts with the Windows PowerShell parser on a Windows CI worker. +4. From a clean standalone checkout of the approved branch, run: + + ```powershell + .\scripts\deploy-iis-git.ps1 -SiteName 'ttasp' -RemoteTarget 'webserver-1' -DryRun + ``` + + This validates and packages locally but makes no network connection. +5. Run `-RemotePreflightOnly` as a separately approved step when host connectivity is permitted. +6. After deployment, require the installer smoke test and then run any production-safe HTTP checks. Never expose the `tests/` IIS application in production. + +Linux can validate XML and inspect script structure, but cannot prove Windows PowerShell, WebAdministration, Classic ASP, IIS URL Rewrite, Access/ACE, SSH elevation, or live HTTP behavior. Those checks remain Windows/IIS gates. + ## Limitations - This harness runs only inside IIS/Classic ASP; it is not intended for Linux execution.