@akash-chowdhury-24/deployhub 2.0.15 → 2.0.16

package/README.md

@@ -229,9 +229,22 @@ Or push to `main` / `master` — the generated workflow runs the same command.
 deployhub artifact list              # local artifacts
 deployhub artifact list --remote     # include storage history.json
 deployhub artifact restore <buildId> # download a past build
-deployhub deploy                     # deploy latest artifact without rebuilding
-deployhub rollback                   # previous build from history
-deployhub rollback <buildId>         # exact build (required if semver is ambiguous)
+
+deployhub deploy                     # deploy latest artifact to defaultEnvironment
+deployhub deploy --env staging       # deploy one named environment
+deployhub deploy --env all           # every enabled environment (skips disabled)
+
+deployhub rollback                   # previous build for defaultEnvironment
+deployhub rollback --env production  # roll back one env using its own history
+deployhub rollback 1.0.6-a1b2c3d --env staging
+deployhub rollback --env all         # continue-on-error across enabled envs
+
+deployhub env list                   # list environments (method, status, last deploy)
+deployhub env add staging            # add an environment (interactive method prompts)
+deployhub env enable staging         # include in deploy / --env all
+deployhub env disable staging        # exclude without deleting config
+deployhub env remove staging         # remove env (re-point defaultEnvironment first if needed)
+
 deployhub sync-workflows             # regenerate deploy + rollback GitHub Actions YAML
 deployhub sync-k8s-ports             # fix containerPort/targetPort in existing k8s manifests
 deployhub logs                       # last deployment logs
@@ -239,7 +252,7 @@ deployhub logs                       # last deployment logs
 
 ### Rollback behavior
 
-`deployhub rollback` restores a previous artifact from storage `history.json` and redeploys it:
+`deployhub rollback` restores a previous artifact from **that environment's** `envs/{env}/history.json` (legacy project `history.json` is treated as the default env's history) and redeploys it:
 
 | Argument | Behavior |
 |----------|----------|
@@ -293,12 +306,14 @@ Artifacts appear under `artifact/{projectName}/{date}/v{buildId}/` locally.
 **Remote storage** (S3 and other providers) uses a different layout:
 
 ```text
-{project}/builds/{buildId}/artifact.zip   # immutable per CI/build
-{project}/history.json                    # newest-first index for rollback / list --remote
-{project}/latest/artifact.zip             # mutable pointer overwritten every upload (NOT a backup)
+{project}/builds/{buildId}/artifact.zip          # immutable per CI/build (shared across envs)
+{project}/history.json                           # build catalog for artifact list --remote
+{project}/latest/artifact.zip                    # last uploaded build (NOT a backup)
+{project}/envs/{env}/history.json                # per-environment deploy history (rollback)
+{project}/envs/{env}/latest/artifact.zip         # last deploy to that env (NOT a backup)
 ```
 
-`buildId` is unique per pipeline run (e.g. `1.0.6-a1b2c3d`) even if `package.json` semver is unchanged. Legacy keys `{project}/v{semver}/artifact.zip` are no longer written; they remain readable for older uploads only.
+`buildId` is unique per pipeline run (e.g. `1.0.6-a1b2c3d`) even if `package.json` semver is unchanged. Legacy keys `{project}/v{semver}/artifact.zip` are no longer written; they remain readable for older uploads only. Build once, then promote the same `buildId` to any environment with `deployhub deploy --env`.
 
 ### Same steps for other languages
 
@@ -987,23 +1002,35 @@ Run `deployhub doctor` after any config change.
 
 | Command | Description |
 |---------|-------------|
-| `deployhub init` | Interactive project setup |
-| `deployhub build` | Full pipeline: detect → install → test → build → artifact → storage → deploy |
+| `deployhub init` | Interactive project setup (one or multiple environments) |
+| `deployhub build` | Full pipeline: detect → install → test → build → artifact → storage → deploy (default / push-triggered envs) |
 | `deployhub artifact create` | Create artifact from current build |
 | `deployhub artifact list [--remote]` | List local artifacts; `--remote` merges storage `history.json` |
 | `deployhub artifact restore <buildId\|semver>` | Download and extract an artifact |
 | `deployhub storage add <provider>` | Add storage provider credentials |
 | `deployhub storage list` | List storage providers and connection status |
-| `deployhub deploy` | Deploy latest artifact |
-| `deployhub rollback [buildId\|semver]` | Previous build, or exact buildId (ambiguous semver lists matches and exits) |
+| `deployhub deploy` | Deploy latest artifact to `defaultEnvironment` |
+| `deployhub deploy --env staging` | Deploy to one named environment |
+| `deployhub deploy --env all` | Deploy to every enabled environment (skips disabled) |
+| `deployhub rollback` | Roll back `defaultEnvironment` to its previous build |
+| `deployhub rollback --env production` | Roll back one env from `envs/{env}/history.json` |
+| `deployhub rollback <buildId> --env staging` | Restore an exact `buildId` to that environment |
+| `deployhub rollback --env all` | Roll back each enabled env (continue-on-error + summary) |
+| `deployhub env list` | List environments (method, enabled, trigger, last deploy) |
+| `deployhub env add <name>` | Add an environment (interactive method prompts; regenerates workflows) |
+| `deployhub env enable <name>` | Enable an environment for deploy / `--env all` |
+| `deployhub env disable <name>` | Disable without deleting config |
+| `deployhub env remove <name>` | Remove an environment (re-point `defaultEnvironment` first if needed) |
 | `deployhub sync-workflows` | Regenerate `.github/workflows/deployhub.yml` and `deployhub-rollback.yml` from config |
 | `deployhub sync-k8s-ports` | Update only `containerPort` / `targetPort` in `k8s/deployment.yaml` and `k8s/service.yaml` from Dockerfile `EXPOSE` (or config/fallback). Does **not** change replicas, resources, env, or probes. Heavily customized / multi-container manifests may need a manual review |
 | `deployhub logs` | Show logs from last deployment |
-| `deployhub doctor` | Pre-flight checks (including an informational warning if the rollback workflow file is missing) |
+| `deployhub doctor [--all]` | Pre-flight checks per environment (`--all` includes disabled envs as informational) |
 | `deployhub verify` | Health check on configured endpoint |
 | `deployhub clean` | Remove old local artifacts |
 | `deployhub update` | Check for CLI updates |
 
+**Tests:** `npm test` — currently **270 passing** across the Jest suites.
+
 ## GitHub Secrets
 
 Add these secrets in your repository (Settings → Secrets and variables → Actions). Only add secrets for providers you selected during `init`. At the end of `deployhub init`, DeployHub prints the exact list for your project.
@@ -1072,6 +1099,8 @@ The doctor command runs independent checks and always completes without crashing
 
 The **Rollback workflow** check is informational and non-blocking (`✓` even when the file is missing). It suggests `deployhub sync-workflows` so already-initialized projects can pick up `deployhub-rollback.yml` without a full re-init. When the file exists, the message confirms the path instead.
 
+If checked-in workflow files exist but are **out of date** with `deployhub.config.json` (e.g. you ran `env add` or a silent migration and forgot `sync-workflows`), doctor also reports an informational **Workflow sync** nudge naming the missing environment or secret and suggesting `deployhub sync-workflows`. That check never fails the doctor exit code.
+
 If checks fail:
 
 ```
@@ -1104,9 +1133,11 @@ artifact/
 **Remote keys** (all storage providers):
 
 ```
-{project}/builds/{buildId}/artifact.zip
-{project}/history.json
-{project}/latest/artifact.zip    # overwritten every build — convenience pointer only, not version history
+{project}/builds/{buildId}/artifact.zip          # immutable per CI/build (shared across envs)
+{project}/history.json                           # build catalog for artifact list --remote
+{project}/latest/artifact.zip                    # overwritten every build — convenience pointer only
+{project}/envs/{env}/history.json                # per-environment deploy history (rollback)
+{project}/envs/{env}/latest/artifact.zip         # last deploy to that env (NOT a backup)
 ```
 
 Legacy (read-only fallback, no longer written): `{project}/v{semver}/artifact.zip`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akash-chowdhury-24/deployhub",
-  "version": "2.0.15",
+  "version": "2.0.16",
   "description": "Zero-configuration deployment and artifact manager",
   "type": "module",
   "main": "./src/cli/index.js",

package/src/artifact/engine.js

@@ -13,6 +13,12 @@ import {
   copyDeployAssetsToArtifactDir,
 } from '../utils/scaffold.js';
 import { getGeneratedByMetadata, getArtifactReadmeFooter } from '../utils/author.js';
+import {
+  getEnabledEnvironmentNames,
+  getEnvMethod,
+  getEnvSettings,
+  resolveDefaultEnvironmentName,
+} from '../core/config.js';
 
 /**
  * @param {string} cwd
@@ -151,13 +157,14 @@ async function stageFrontendArtifact(cwd, stagingDir, config) {
 
   await copyKubernetesManifestsIfPresent(cwd, stagingDir);
 
-  const hasSshDeploy = (config.deploy || []).some(
-    (envName) => config.environments[envName]?.type === 'ssh'
+  const deployTargets = getEnabledEnvironmentNames(config);
+  const hasSshDeploy = deployTargets.some(
+    (envName) => getEnvMethod(config.environments[envName]) === 'ssh'
   );
 
   if (hasSshDeploy && !fs.existsSync(path.join(stagingDir, 'nginx.conf'))) {
-    const envName = config.deploy?.[0];
-    const env = envName ? config.environments[envName] : null;
+    const envName = resolveDefaultEnvironmentName(config) || deployTargets[0];
+    const env = envName ? getEnvSettings(config.environments[envName]) : null;
     const deployPath =
       env?.frontendDeployPath || env?.deployPath || env?.path || `/var/www/${config.project}`;
     const nginxConf = generateNginxConfig(config.project, deployPath, outputName);

package/src/cli/index.js

@@ -15,6 +15,7 @@ import { registerCleanCommand } from '../commands/clean.js';
 import { registerUpdateCommand } from '../commands/update.js';
 import { registerSyncWorkflowsCommand } from '../commands/sync-workflows.js';
 import { registerSyncK8sPortsCommand } from '../commands/sync-k8s-ports.js';
+import { registerEnvCommand } from '../commands/env.js';
 import { formatVersionOutput, printBanner, shouldShowBanner } from '../utils/author.js';
 
 loadEnv();
@@ -45,5 +46,6 @@ registerCleanCommand(program);
 registerUpdateCommand(program);
 registerSyncWorkflowsCommand(program);
 registerSyncK8sPortsCommand(program);
+registerEnvCommand(program);
 
 program.parse();

package/src/commands/deploy.js

@@ -1,10 +1,16 @@
 import chalk from 'chalk';
 import { loadConfig, loadEnv } from '../core/config.js';
+import { resolveEnvTargets } from '../core/environments.js';
 import { runPipeline } from '../core/pipeline.js';
 import { listLocalArtifacts } from '../artifact/engine.js';
 import { deployToAll } from '../deployment/index.js';
 import { sendNotifications } from '../notifications/index.js';
-import axios from 'axios';
+import {
+  anyEnvHasResolvableHealthCheckUrl,
+  runHealthChecksForEnvs,
+  formatHealthCheckAllSummary,
+} from '../utils/health-check.js';
+import { createLogger } from '../logger/index.js';
 
 /**
  * @param {import('commander').Command} program
@@ -12,11 +18,34 @@ import axios from 'axios';
 export function registerDeployCommand(program) {
   program
     .command('deploy')
-    .description('Deploy the latest artifact')
-    .action(async () => {
+    .description('Deploy the latest artifact (default environment, or --env)')
+    .option(
+      '--env <name>',
+      'Environment to deploy (name, or "all" for every enabled environment)'
+    )
+    .action(async (opts) => {
       loadEnv();
       const cwd = process.cwd();
       const config = await loadConfig(cwd);
+      const log = createLogger('deploy');
+
+      let targets;
+      let skippedDisabled;
+      try {
+        ({ targets, skippedDisabled } = resolveEnvTargets(config, opts.env));
+      } catch (err) {
+        console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        process.exit(1);
+      }
+
+      for (const name of skippedDisabled) {
+        log.info(`Skipping disabled environment "${name}"`);
+      }
+
+      if (targets.length === 0) {
+        console.error(chalk.red('No enabled environments to deploy.'));
+        process.exit(1);
+      }
 
       const artifacts = await listLocalArtifacts(cwd);
       if (artifacts.length === 0) {
@@ -34,27 +63,43 @@ export function registerDeployCommand(program) {
           async run(ctx) {
             const deployed = await deployToAll(
               ctx.config,
-              /** @type {string} */ (ctx.state.artifactDir)
+              /** @type {string} */ (ctx.state.artifactDir),
+              targets
             );
             ctx.state.deployedTargets = deployed;
           },
         },
         {
           name: 'verify',
-          enabled: (ctx) => !!ctx.config.healthCheck?.url,
+          enabled: (ctx) => {
+            const deployed = /** @type {string[]} */ (
+              ctx.state.deployedTargets || targets
+            );
+            return anyEnvHasResolvableHealthCheckUrl(ctx.config, deployed);
+          },
           async run(ctx) {
-            const url = ctx.config.healthCheck.url;
-            const timeout = (ctx.config.healthCheck.timeout || 30) * 1000;
-            const start = Date.now();
-            const response = await axios.get(url, {
-              timeout,
-              validateStatus: () => true,
-            });
-            const elapsed = Date.now() - start;
-            if (response.status < 200 || response.status >= 400) {
-              throw new Error(`Health check failed: HTTP ${response.status}`);
+            const deployed = /** @type {string[]} */ (
+              ctx.state.deployedTargets || targets
+            );
+            const { results, failures } = await runHealthChecksForEnvs(
+              ctx.config,
+              deployed
+            );
+
+            if (deployed.length > 1 || failures.length > 0) {
+              console.log('');
+              console.log(formatHealthCheckAllSummary(results, failures));
+            } else if (results[0]) {
+              console.log(
+                chalk.green(
+                  `Health check passed (${results[0].envName}): HTTP ${results[0].status} (${results[0].elapsed}ms)`
+                )
+              );
+            }
+
+            if (failures.length > 0) {
+              throw new Error(failures[0].error);
             }
-            console.log(chalk.green(`Health check passed: ${response.status} (${elapsed}ms)`));
           },
         },
         {

package/src/commands/doctor.js

@@ -4,14 +4,21 @@ import fs from 'fs-extra';
 import path from 'path';
 import os from 'os';
 import axios from 'axios';
-import { loadConfig, loadEnv } from '../core/config.js';
+import { loadConfig, loadEnv, getEnvMethod, getEnvSettings } from '../core/config.js';
+import {
+  isEnvEnabled,
+  resolveDefaultEnvironmentName,
+} from '../core/environments.js';
+import { loadEnvArtifactHistory } from '../storage/index.js';
 import { testProvider } from '../storage/index.js';
 import { getDeploymentProvider } from '../deployment/index.js';
-import { PROVIDER_ENV_MAP, getRollbackWorkflowDoctorCheck } from '../utils/github-actions.js';
+import { PROVIDER_ENV_MAP, getRollbackWorkflowDoctorCheck, getWorkflowDriftDoctorChecks } from '../utils/github-actions.js';
 import { printDoctorFooter } from '../utils/author.js';
 import { createLocalProvider } from '../storage/providers/local.js';
 import {
   getDeploymentEnvKeys,
+  getDeploymentSecretKeysForEnv,
+  envUsesPrefixedSecrets,
   getDeploymentSecretKeys,
 } from '../deployment/deployment-env.js';
 import { testSshConnectivity, validateSshKeyForDoctor, testSshHostReachability } from '../deployment/init-helpers.js';
@@ -27,6 +34,62 @@ import { namespaceExists } from '../utils/kubernetes-namespace.js';
  * @typedef {{ name: string, pass: boolean, message: string }} CheckResult
  */
 
+/**
+ * Whether doctor should `process.exit(1)` — only blocking (non-informational) failures count.
+ * @param {CheckResult[]} results
+ * @param {Set<string>} informationalCheckNames
+ * @returns {boolean}
+ */
+export function doctorHasBlockingFailures(results, informationalCheckNames) {
+  const blocking = results.filter((r) => !informationalCheckNames.has(r.name));
+  return blocking.some((r) => !r.pass);
+}
+
+/**
+ * Run per-env deployment checks with try/catch isolation (one env crash does not abort others).
+ * Disabled env failures are marked informational when `includeDisabled` is true.
+ *
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @param {string[]} envNames
+ * @param {{ includeDisabled?: boolean, runChecks?: typeof runDeploymentChecks }} [options]
+ * @returns {Promise<{ results: CheckResult[], informationalCheckNames: Set<string> }>}
+ */
+export async function collectEnvDeploymentChecks(config, envNames, options = {}) {
+  const includeDisabled = options.includeDisabled === true;
+  const runChecks = options.runChecks || runDeploymentChecks;
+  /** @type {CheckResult[]} */
+  const results = [];
+  /** @type {Set<string>} */
+  const informationalCheckNames = new Set();
+
+  for (const envName of envNames) {
+    const env = config.environments?.[envName];
+    if (!env) continue;
+    const enabled = isEnvEnabled(env);
+    if (!enabled && !includeDisabled) continue;
+
+    try {
+      const deployChecks = await runChecks(config, envName, env);
+      for (const c of deployChecks) {
+        c.name = `${envName}/${c.name}`;
+        results.push(c);
+        if (!enabled) informationalCheckNames.add(c.name);
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const name = `${envName}/checks`;
+      results.push({
+        name,
+        pass: false,
+        message: `Check aborted: ${message}`,
+      });
+      if (!enabled) informationalCheckNames.add(name);
+    }
+  }
+
+  return { results, informationalCheckNames };
+}
+
 /** @type {Set<string>} */
 const NODE_FRAMEWORKS = new Set(['express', 'nestjs', 'fastify', 'koa', 'nextjs', 'node']);
 /** @type {Set<string>} */
@@ -102,9 +165,10 @@ function needsNginxActivationForDeploy(config) {
  * @param {Record<string, unknown>} envConfig
  * @returns {Promise<CheckResult[]>}
  */
-async function runDeploymentChecks(config, envName, envConfig) {
-  const deployType = envConfig.type;
+export async function runDeploymentChecks(config, envName, envConfig) {
+  const deployType = getEnvMethod(envConfig);
   if (!deployType || typeof deployType !== 'string') return [];
+  const settings = getEnvSettings(envConfig);
 
   /** @type {CheckResult[]} */
   const checks = [];
@@ -134,10 +198,10 @@ async function runDeploymentChecks(config, envName, envConfig) {
   );
 
   if (SSH_DEPLOY_TYPES.has(deployType)) {
-    const host = envConfig.host || process.env.SSH_HOST;
-    const user = envConfig.user || process.env.SSH_USER;
-    const keyPath = envConfig.keyPath || process.env.SSH_KEY_PATH;
-    const sshPort = Number(process.env.SSH_SSH_PORT || envConfig.sshPort) || 22;
+    const host = settings.host || process.env.SSH_HOST;
+    const user = settings.user || process.env.SSH_USER;
+    const keyPath = settings.keyPath || process.env.SSH_KEY_PATH;
+    const sshPort = Number(process.env.SSH_SSH_PORT || settings.sshPort) || 22;
 
     checks.push(
       await runCheck('SSH key', async () => {
@@ -171,7 +235,7 @@ async function runDeploymentChecks(config, envName, envConfig) {
       })
     );
 
-    const deployPaths = resolveSshDeployPaths(config, envConfig);
+    const deployPaths = resolveSshDeployPaths(config, settings);
     const sshUser = String(user || process.env.SSH_USER || 'your-user');
 
     for (const deployPath of deployPaths) {
@@ -634,11 +698,17 @@ export function registerDoctorCommand(program) {
   program
     .command('doctor')
     .description('Run pre-flight checks before deploying')
-    .action(async () => {
+    .option(
+      '--all',
+      'Also run method checks for disabled environments (failures are informational only)'
+    )
+    .action(async (opts) => {
       loadEnv();
       const cwd = process.cwd();
       /** @type {CheckResult[]} */
       const results = [];
+      /** @type {Set<string>} names of checks that must not fail the summary */
+      const informationalCheckNames = new Set();
 
       results.push(
         await runCheck('Git', async () => {
@@ -801,14 +871,49 @@ export function registerDoctorCommand(program) {
           }
         }
 
-        for (const envName of config.deploy || []) {
-          const env = config.environments[envName];
-          if (!env) continue;
-
-          const deployChecks = await runDeploymentChecks(config, envName, env);
-          results.push(...deployChecks);
+        // Per-environment summary + method checks (enabled by default; --all includes disabled)
+        const envNames = Object.keys(config.environments || {});
+        if (envNames.length > 0) {
+          console.log('');
+          console.log(chalk.bold('Environments:'));
+          for (const envName of envNames) {
+            const env = config.environments[envName];
+            const method = getEnvMethod(env) || '?';
+            const enabled = isEnvEnabled(env);
+            const status = enabled ? 'enabled' : 'disabled';
+            let last = 'never';
+            try {
+              const { entries } = await loadEnvArtifactHistory(
+                config.storage || [],
+                config.project,
+                envName,
+                { defaultEnvironment: resolveDefaultEnvironmentName(config) }
+              );
+              if (entries[0]?.buildId) {
+                last = entries[0].buildId;
+              }
+            } catch {
+              // doctor never crashes
+            }
+            const icon = enabled ? chalk.green('✓') : chalk.gray('–');
+            const hint = enabled
+              ? `last deploy: ${last}`
+              : `run \`deployhub env enable ${envName}\``;
+            console.log(
+              `  ${icon} ${envName.padEnd(14)} (${method})`.padEnd(36) +
+                `${status.padEnd(10)} — ${hint}`
+            );
+          }
+          console.log('');
         }
 
+        const { results: envResults, informationalCheckNames: envInfo } =
+          await collectEnvDeploymentChecks(config, envNames, {
+            includeDisabled: Boolean(opts.all),
+          });
+        results.push(...envResults);
+        for (const name of envInfo) informationalCheckNames.add(name);
+
         results.push(
           await runCheck('Health endpoint', async () => {
             const url = config.healthCheck?.url;
@@ -851,10 +956,13 @@ export function registerDoctorCommand(program) {
             const keys = PROVIDER_ENV_MAP[provider] || [];
             required.push(...keys);
           }
-          for (const envName of config.deploy || []) {
+          for (const envName of Object.keys(config.environments || {})) {
             const env = config.environments[envName];
-            if (!env?.type) continue;
-            required.push(...getDeploymentSecretKeys(env.type, config));
+            if (!isEnvEnabled(env)) continue;
+            const method = getEnvMethod(env);
+            if (!method) continue;
+            // Local/.env uses unprefixed names; prefixed CI names are checked separately below.
+            required.push(...getDeploymentSecretKeys(method, config));
           }
 
           const unique = [...new Set(required)];
@@ -871,10 +979,65 @@ export function registerDoctorCommand(program) {
               message: `Missing: ${missing.join(', ')}`,
             };
           }
-          return { name: 'Secrets', pass: true, message: 'All required env vars present' };
+          return { name: 'Secrets', pass: true, message: 'All required secrets present' };
         })
       );
 
+      // Explicit CI-prefixed secret reminders for non-grandfathered environments
+      if (config) {
+        const inCi = process.env.GITHUB_ACTIONS === 'true' || process.env.CI === 'true';
+        for (const envName of Object.keys(config.environments || {})) {
+          const env = config.environments[envName];
+          if (!isEnvEnabled(env)) continue;
+          if (!envUsesPrefixedSecrets(envName, config)) continue;
+          const method = getEnvMethod(env);
+          if (!method) continue;
+
+          const prefixedKeys = getDeploymentSecretKeysForEnv(
+            envName,
+            method,
+            config,
+            config.environments
+          );
+          const baseKeys = getDeploymentSecretKeys(method, config);
+
+          for (let i = 0; i < baseKeys.length; i++) {
+            const base = baseKeys[i];
+            const prefixed = prefixedKeys[i] || base;
+            if (prefixed === base) continue;
+
+            const checkName = `CI secret ${prefixed}`;
+            results.push(
+              await runCheck(checkName, async () => {
+                if (process.env[prefixed]) {
+                  return {
+                    name: checkName,
+                    pass: true,
+                    message: `Present for environment "${envName}"`,
+                  };
+                }
+                const localFallback =
+                  base === 'SSH_KEY'
+                    ? process.env.SSH_KEY || process.env.SSH_KEY_PATH
+                    : process.env[base];
+                if (!inCi && localFallback) {
+                  return {
+                    name: checkName,
+                    pass: false,
+                    message: `Add GitHub Actions secret "${prefixed}" for env "${envName}" (local has ${base}, but CI needs the prefixed name)`,
+                  };
+                }
+                return {
+                  name: checkName,
+                  pass: false,
+                  message: `Missing — add GitHub Actions secret "${prefixed}" for environment "${envName}"`,
+                };
+              })
+            );
+          }
+        }
+      }
+
       results.push(
         await runCheck('GitHub Actions', async () => {
           const workflowPath = path.join(cwd, '.github', 'workflows', 'deployhub.yml');
@@ -910,6 +1073,13 @@ export function registerDoctorCommand(program) {
         );
       }
 
+      if (config) {
+        const driftChecks = await getWorkflowDriftDoctorChecks(cwd, config);
+        for (const check of driftChecks) {
+          results.push(await runCheck(check.name, async () => check));
+        }
+      }
+
       results.push(
         await runCheck('Storage write', async () => {
           const provider = createLocalProvider();
@@ -928,14 +1098,21 @@ export function registerDoctorCommand(program) {
       );
 
       console.log('');
-      const pad = (name) => name.padEnd(22);
+      const pad = (name) => name.padEnd(28);
       for (const r of results) {
-        const icon = r.pass ? chalk.green('✓') : chalk.red('✗');
-        console.log(`  Checking ${pad(r.name)}...  ${icon} ${r.message}`);
+        const info = informationalCheckNames.has(r.name);
+        const icon = r.pass
+          ? chalk.green('✓')
+          : info
+            ? chalk.yellow('!')
+            : chalk.red('✗');
+        const suffix = info && !r.pass ? chalk.gray(' (informational — disabled env)') : '';
+        console.log(`  Checking ${pad(r.name)}...  ${icon} ${r.message}${suffix}`);
       }
 
-      const passed = results.filter((r) => r.pass).length;
-      const total = results.length;
+      const blocking = results.filter((r) => !informationalCheckNames.has(r.name));
+      const passed = blocking.filter((r) => r.pass).length;
+      const total = blocking.length;
       console.log('');
       if (passed === total) {
         console.log(chalk.green.bold(`  ✓ Ready to deploy (${passed}/${total} checks passed)`));
@@ -950,7 +1127,16 @@ export function registerDoctorCommand(program) {
       console.log('');
       printDoctorFooter();
       console.log('');
+
+      if (doctorHasBlockingFailures(results, informationalCheckNames)) {
+        process.exit(1);
+      }
     });
 }
 
-export default { registerDoctorCommand };
+export default {
+  registerDoctorCommand,
+  runDeploymentChecks,
+  doctorHasBlockingFailures,
+  collectEnvDeploymentChecks,
+};