Implement a small smoke runner for the deployed API.

• Use a dedicated least-privileged smoke identity.
• Keep checks read-only and repeatable.
• Bound total runtime.
• Return useful step names without tokens or payload secrets.

I keep smoke coverage intentionally small. Readiness proves traffic eligibility; one authenticated read proves routing, auth, and a required data path. Deeper regression remains in CI and staging rather than running destructive workflows after every production deployment.

public static async Task<int> RunSmokeAsync(
    HttpClient client,
    string accessToken,
    CancellationToken cancellationToken)
{
    using var timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
    timeout.CancelAfter(TimeSpan.FromSeconds(20));

    using var ready = await client.GetAsync("/health/ready", timeout.Token);
    if (!ready.IsSuccessStatusCode)
        return SmokeFailure.Readiness;

    client.DefaultRequestHeaders.Authorization =
        new AuthenticationHeaderValue("Bearer", accessToken);

    using var profile = await client.GetAsync("/api/profile", timeout.Token);
    if (!profile.IsSuccessStatusCode)
        return SmokeFailure.AuthenticatedRead;

    return SmokeFailure.None;
}

The runner makes two bounded read calls and exits with a machine-readable step code for the deployment pipeline. Tokens come from secret storage and must never appear in output.

• Readiness is healthy but authentication configuration is wrong.
• The smoke token is expired.
• The API hangs rather than failing.
• Repeated checks overlap during rollout.

• Run against a controlled staging deployment first.
• Verify logs contain no token.
• Force each step to fail and check the returned code.
• Keep the smoke identity unable to mutate data.

• Using an admin token for convenience.
• Creating orders or users in production smoke checks.
• Running the full regression suite against production.
• Printing response bodies that may contain sensitive data.