feat: ship a smoke-test script with every release - #8

What

Every release zip now carries a script that proves the download works. Start the simulator, run smoke-test.ps1 or smoke-test.sh, and it exercises the whole documented contract — 25 checks — printing PASS or FAIL for each.

Service endpoints
  PASS  GET /healthz returns 200
  PASS  GET /healthz body
Valid payloads
  PASS  POST {"key":"value"} -> 200 true
  ...
Contract details
  PASS  Response declares JSON content type
  PASS  Nesting deeper than 64 -> 400
  PASS  Body over 1 MB -> 413

All 25 checks passed.

Exit codes: 0 all passed, 1 something failed (with expected vs actual), 2 the simulator is not reachable. That makes it usable as a CI gate, not just a demo.

The container smoke test in CI now runs that same script instead of a few inline curl calls, so the tool that ships to users is exercised on every pull request and cannot rot unnoticed.

Contract impact

• Endpoint(s): none
• Status code changed: no
• Response body changed: no

/version now reports 1.0.4+<sha> instead of 1.0.3+<sha>.<sha>. The release pipeline appends the commit sha to InformationalVersion and the SDK appended it a second time; IncludeSourceRevisionInInformationalVersion is off now. The shape of the response is unchanged.

Driving it from a browser

/healthz and /version open directly. The validation endpoint is POST-only, so a URL alone will not reach it — open http://localhost:5000/healthz first, then use fetch from the console. Being on the simulator's own origin is what avoids CORS, since no CORS policy is configured.

const r = await fetch('/api/target', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: '{"key":"value"}'
});
console.log(r.status, await r.text());   // 200 true

Verified in a real browser: same-origin fetch returns 200 with body true, 400 for invalid JSON, 200 for a bare scalar.

Checklist

• This is a release PR into master, so it targets master by design
• dotnet test passes locally — 131 tests
• dotnet format --verify-no-changes is clean
• Both scripts run green against a live instance and against the container — 25/25
• Failure paths checked: exit 1 on mismatch, exit 2 when unreachable
• smoke-test.sh is stored with LF in git, so the shebang survives on Linux
• README updated with the script and the browser recipe
• Validation contract unchanged; no request or response behaviour was touched
• VERSION.md bumped to 1.0.4 and CHANGELOG.md has a [1.0.4] section

How to verify after release

unzip TargetApiSimulator-1.0.4-linux-x64.zip -d tas && cd tas
./TargetApiSimulator --urls http://localhost:5000 &
./smoke-test.sh