feat: verify deployment on a draft, activate on success (#805)

* feat: verify deployment on a draft, activate on success (#769)

Deploy commands now deploy the new bundle as a draft (activate=false),
verify it by accessing its preview URL, and only activate it once the
verification succeeds. If verification fails, the bundle is left as a
draft and the previously-active bundle keeps serving, so a broken build
never becomes the active version.

This also fixes #768: --draft now verifies the draft bundle rather than
the currently-active content. --no-verify retains the old behavior of
activating immediately without verification.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: avoid double slash in access_content preview path

dirname("/__api__") returns "/", so joining it with "/content/..."
produced a "//content/..." path. Connect normalizes it, but it is sloppy
and made the verification request URL awkward to register in tests. Strip
the trailing slash from the base so root-hosted and path-prefixed servers
both produce a clean single-slash path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test: integration tests for verify-before-activate

Add two live-Connect integration tests (run via posit-dev/with-connect)
that exercise the verify-before-activate guarantees and are expected to
fail without the changes on this branch:

- test_default_deploy_does_not_activate_broken_bundle (#769): a broken
  redeploy fails and leaves the previously-active working bundle serving;
  without the change the broken bundle is activated before verification.
- test_draft_deploy_verifies_the_draft_not_the_active_bundle (#768):
  deploying a broken draft fails verification; without the change --draft
  verified the still-good active content and reported success.

Both reuse the existing flask / flask-bad fixtures (flask-bad builds fine
but raises at startup).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: version-gate the verify-before-activate flow

Connect added the `activate` field on the deploy endpoint in 2025.06.0;
older servers reject the unknown field, which broke every deploy against
them once verify-before-activate became the default. Gate the draft-first
flow on server version: on Connect >= 2025.06.0 we deploy a draft, verify
it, and activate on success; on older servers (and shinyapps.io) we deploy
and activate in one step and verify the active content, as before.

Add a unit test for the fallback path on an unsupported server, and bump
the two live integration tests to require Connect 2025.06.0 since they
assert the verify-before-activate behavior.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: error clearly when --draft used against unsupported Connect

should_deploy_as_draft() returned True for --draft regardless of server
support, so --draft against Connect < 2025.06.0 still sent activate:false
and failed with a cryptic "unknown field" error. Raise a clear
RSConnectException instead; silently downgrading to a non-draft deploy
would activate the bundle, the opposite of --draft's intent. Add a unit
test for --draft on an unsupported server.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: nealrichardson

docs/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+- `rsconnect deploy` commands now verify content before activating it. The new
+  bundle is deployed as a draft, its preview URL is accessed to confirm the
+  content starts, and only then is the bundle activated. If verification fails,
+  the bundle is left as a draft and the previously-active bundle keeps serving,
+  so a broken build never becomes the active version. `--draft` still deploys
+  without activating (and now verifies the draft rather than the active
+  content), and `--no-verify` skips verification and activates immediately.
+  Draft deploys require Connect 2025.06.0 or later; against older servers the
+  bundle is deployed and activated in one step and the active content is
+  verified, as before.
 - `rsconnect deploy` commands now check PyPI once a day for a newer release of
   rsconnect-python and print an upgrade hint to stderr when one is available.
   The result is cached so most invocations make no network request. Set

rsconnect/api.py

@@ -390,6 +390,7 @@ class RSConnectClientDeployResult(TypedDict):
     app_url: str
     dashboard_url: str
     draft_url: str | None
+    bundle_id: str | None
     title: str | None
 
 
@@ -413,6 +414,29 @@ def server_supports_git_metadata(server_version: Optional[str]) -> bool:
         return False
 
 
+def server_supports_draft_deploy(server_version: Optional[str]) -> bool:
+    """
+    Check if the server supports deploying a bundle as a draft and activating it
+    separately, i.e. the ``activate`` field on the content deploy/build endpoints.
+
+    Older servers reject the unknown field, so we must not send it to them.
+
+    Draft deploys were added in Connect 2025.06.0.
+
+    :param server_version: The Connect server version string
+    :return: True if the server supports draft deploys, False otherwise
+    """
+    if not server_version:
+        return False
+
+    try:
+        return compare_semvers(server_version, "2025.06.0") >= 0
+    except Exception:
+        # If we can't parse the version, assume it doesn't support it
+        logger.debug(f"Unable to parse server version: {server_version}")
+        return False
+
+
 class RSConnectClient(HTTPServer):
     def __init__(self, server: Union[RSConnectServer, SPCSConnectServer], cookies: Optional[CookieJar] = None):
         if cookies is None:
@@ -599,10 +623,15 @@ def add_environment_vars(self, content_guid: str, env_vars: list[tuple[str, str]
     def is_failed_response(self, response: HTTPResponse | JsonData) -> bool:
         return isinstance(response, HTTPResponse) and response.status >= 500
 
-    def access_content(self, content_guid: str) -> None:
+    def access_content(self, content_guid: str, bundle_id: Optional[str] = None) -> None:
         method = "GET"
-        base = dirname(self._url.path)  # remove __api__
-        path = f"{base}/content/{content_guid}/"
+        base = dirname(self._url.path).rstrip("/")  # strip "__api__" and any trailing slash
+        # Access a specific (e.g. draft, not-yet-activated) bundle's preview URL when a
+        # bundle id is given. Connect spins the process up cold to serve this, so a
+        # successful response confirms the bundle actually runs without touching the
+        # active bundle.
+        suffix = f"_bundle{bundle_id}/" if bundle_id is not None else ""
+        path = f"{base}/content/{content_guid}/{suffix}"
         response = self._do_request(method, path, None, None, 3, {}, False)
 
         if self.is_failed_response(response):
@@ -892,6 +921,7 @@ def deploy(
             "app_url": app["content_url"],
             "dashboard_url": app["dashboard_url"],
             "draft_url": draft_url if not activate else None,
+            "bundle_id": app_bundle["id"],
             "title": app["title"],
         }
 
@@ -1025,6 +1055,7 @@ def __init__(
 
         self.bundle: IO[bytes] | None = None
         self.deployed_info: RSConnectClientDeployResult | None = None
+        self._draft_deploy_supported: bool | None = None
 
         self.logger: logging.Logger | None = logger
         self.ctx = ctx
@@ -1405,6 +1436,7 @@ def deploy_bundle(self, activate: bool = True):
                 app_guid=None,
                 task_id=None,
                 draft_url=None,
+                bundle_id=None,
                 title=self.title,
             )
             return self
@@ -1472,14 +1504,74 @@ def save_deployed_info(self):
 
         return self
 
+    @property
+    def supports_verify_before_activate(self) -> bool:
+        """Whether the target server supports deploying a bundle as a draft and
+        activating it separately. shinyapps.io / Posit Cloud and pre-2025.06.0 Connect
+        do not, so for those we deploy and activate in one step and verify the active
+        content instead."""
+        if not isinstance(self.client, RSConnectClient):
+            return False
+        if self._draft_deploy_supported is None:
+            try:
+                server_version = self.client.server_settings().get("version", "")
+            except Exception:
+                server_version = None
+            self._draft_deploy_supported = server_supports_draft_deploy(server_version)
+        return self._draft_deploy_supported
+
+    def should_deploy_as_draft(self, draft: bool, no_verify: bool) -> bool:
+        """Whether the bundle should be deployed without activating it.
+
+        An explicit ``--draft`` always deploys a draft. Otherwise we deploy a draft only
+        when we are going to verify it before activating, which requires server support.
+        With ``--no-verify`` we activate immediately.
+        """
+        if draft:
+            if not self.supports_verify_before_activate:
+                # We can't honor --draft without the activate field: silently activating
+                # would be the opposite of what the user asked for, so fail loudly.
+                raise RSConnectException("Deploying as a draft requires Posit Connect 2025.06.0 or later.")
+            return True
+        if no_verify:
+            return False
+        return self.supports_verify_before_activate
+
     @cls_logged("Verifying deployed content...")
     def verify_deployment(self):
         if isinstance(self.remote_server, (RSConnectServer, SPCSConnectServer)):
             if not isinstance(self.client, RSConnectClient):
                 raise RSConnectException("To verify deployment, client must be a RSConnectClient.")
             deployed_info = self.deployed_info
             app_guid = deployed_info["app_guid"]
-            self.client.access_content(app_guid)
+            # If the bundle was deployed as a draft (not activated), verify the draft
+            # bundle's preview URL rather than the currently-active content. Otherwise a
+            # broken draft would be masked by a previously-working active bundle.
+            bundle_id = deployed_info.get("bundle_id") if deployed_info.get("draft_url") else None
+            self.client.access_content(app_guid, bundle_id=bundle_id)
+        return self
+
+    @cls_logged("Activating deployed content...")
+    def activate_deployment(self):
+        """Activate the bundle deployed as a draft, e.g. after verifying it runs.
+
+        This re-issues the deploy request for the same bundle with ``activate=True``,
+        which is what the "Activate Draft" button in the Connect UI does.
+        """
+        if isinstance(self.remote_server, (RSConnectServer, SPCSConnectServer)):
+            if not isinstance(self.client, RSConnectClient):
+                raise RSConnectException("To activate deployment, client must be a RSConnectClient.")
+            deployed_info = self.deployed_info
+            app_guid = deployed_info["app_guid"]
+            bundle_id = deployed_info["bundle_id"]
+            if app_guid is None or bundle_id is None:
+                raise RSConnectException("An app GUID and bundle ID are required to activate a deployment.")
+            task = self.client.content_deploy(app_guid, bundle_id, activate=True)
+            # Update deployed_info so a subsequent emit_task_log() waits on the activation
+            # task and reports the live content URLs instead of the draft URL.
+            deployed_info["task_id"] = task["task_id"]
+            deployed_info["draft_url"] = None
+        return self
 
     @cls_logged("Validating app mode...")
     def validate_app_mode(self, app_mode: AppMode):

rsconnect/main.py

@@ -392,14 +392,17 @@ def content_args(func: Callable[P, T]) -> Callable[P, T]:
     @click.option(
         "--no-verify",
         is_flag=True,
-        help="Don't access the deployed content to verify that it started correctly.",
+        help=(
+            "Don't access the deployed content to verify that it started correctly. "
+            "Implies activating the new bundle immediately rather than verifying it first."
+        ),
     )
     @click.option(
         "--draft",
         is_flag=True,
         help=(
-            "Deploy the application as a draft. "
-            "Previous bundle will continue to be served until the draft is published."
+            "Deploy the application as a draft and verify it, but do not activate it. "
+            "The previous bundle will continue to be served until the draft is published."
         ),
     )
     @click.option(
@@ -1541,9 +1544,12 @@ def deploy_notebook(
             env_management_r=env_management_r,
             r_environment=r_environment,
         )
-    ce.deploy_bundle(activate=not draft).save_deployed_info().emit_task_log()
+    ce.deploy_bundle(activate=not ce.should_deploy_as_draft(draft, no_verify)).save_deployed_info().emit_task_log()
     if not no_verify:
         ce.verify_deployment()
+        if not draft and ce.supports_verify_before_activate:
+            # The draft bundle verified successfully, so activate it.
+            ce.activate_deployment().emit_task_log()
 
 
 # noinspection SpellCheckingInspection,DuplicatedCode
@@ -1709,9 +1715,12 @@ def deploy_voila(
         env_management_r=env_management_r,
         r_environment=r_environment,
         multi_notebook=multi_notebook,
-    ).deploy_bundle(activate=not draft).save_deployed_info().emit_task_log()
+    ).deploy_bundle(activate=not ce.should_deploy_as_draft(draft, no_verify)).save_deployed_info().emit_task_log()
     if not no_verify:
         ce.verify_deployment()
+        if not draft and ce.supports_verify_before_activate:
+            # The draft bundle verified successfully, so activate it.
+            ce.activate_deployment().emit_task_log()
 
 
 # noinspection SpellCheckingInspection,DuplicatedCode
@@ -1797,12 +1806,15 @@ def deploy_manifest(
             make_manifest_bundle,
             file_name,
         )
-        .deploy_bundle(activate=not draft)
+        .deploy_bundle(activate=not ce.should_deploy_as_draft(draft, no_verify))
         .save_deployed_info()
         .emit_task_log()
     )
     if not no_verify:
         ce.verify_deployment()
+        if not draft and ce.supports_verify_before_activate:
+            # The draft bundle verified successfully, so activate it.
+            ce.activate_deployment().emit_task_log()
 
 
 @deploy.command(
@@ -1887,12 +1899,15 @@ def deploy_bundle(
             open_bundle,
             file,
         )
-        .deploy_bundle(activate=not draft)
+        .deploy_bundle(activate=not ce.should_deploy_as_draft(draft, no_verify))
         .save_deployed_info()
         .emit_task_log()
     )
     if not no_verify:
         ce.verify_deployment()
+        if not draft and ce.supports_verify_before_activate:
+            # The draft bundle verified successfully, so activate it.
+            ce.activate_deployment().emit_task_log()
 
 
 @deploy.command(
@@ -2095,12 +2110,15 @@ def quickstart_hint() -> str:
         ce.validate_server()
         .validate_app_mode(app_mode=app_mode)
         .make_bundle(bundle_builder, *bundle_args, **bundle_kwargs)
-        .deploy_bundle(activate=not draft)
+        .deploy_bundle(activate=not ce.should_deploy_as_draft(draft, no_verify))
         .save_deployed_info()
         .emit_task_log()
     )
     if not no_verify:
         ce.verify_deployment()
+        if not draft and ce.supports_verify_before_activate:
+            # The draft bundle verified successfully, so activate it.
+            ce.activate_deployment().emit_task_log()
 
 
 # noinspection SpellCheckingInspection,DuplicatedCode
@@ -2283,12 +2301,15 @@ def deploy_quarto(
             env_management_r=env_management_r,
             r_environment=r_environment,
         )
-        .deploy_bundle(activate=not draft)
+        .deploy_bundle(activate=not ce.should_deploy_as_draft(draft, no_verify))
         .save_deployed_info()
         .emit_task_log()
     )
     if not no_verify:
         ce.verify_deployment()
+        if not draft and ce.supports_verify_before_activate:
+            # The draft bundle verified successfully, so activate it.
+            ce.activate_deployment().emit_task_log()
 
 
 # noinspection SpellCheckingInspection,DuplicatedCode
@@ -2389,12 +2410,15 @@ def deploy_tensorflow(
             exclude,
             image=image,
         )
-        .deploy_bundle(activate=not draft)
+        .deploy_bundle(activate=not ce.should_deploy_as_draft(draft, no_verify))
         .save_deployed_info()
         .emit_task_log()
     )
     if not no_verify:
         ce.verify_deployment()
+        if not draft and ce.supports_verify_before_activate:
+            # The draft bundle verified successfully, so activate it.
+            ce.activate_deployment().emit_task_log()
 
 
 # noinspection SpellCheckingInspection,DuplicatedCode
@@ -2513,12 +2537,15 @@ def deploy_html(
             extra_files,
             exclude,
         )
-        .deploy_bundle(activate=not draft)
+        .deploy_bundle(activate=not ce.should_deploy_as_draft(draft, no_verify))
         .save_deployed_info()
         .emit_task_log()
     )
     if not no_verify:
         ce.verify_deployment()
+        if not draft and ce.supports_verify_before_activate:
+            # The draft bundle verified successfully, so activate it.
+            ce.activate_deployment().emit_task_log()
 
 
 def resolve_requirements_file(directory: str, requirements_file: Optional[str], force_generate: bool) -> Optional[str]:
@@ -2747,12 +2774,15 @@ def deploy_app(
             env_management_r=env_management_r,
             r_environment=r_environment,
         )
-        ce.deploy_bundle(activate=not draft)
+        ce.deploy_bundle(activate=not ce.should_deploy_as_draft(draft, no_verify))
         ce.save_deployed_info()
         ce.emit_task_log()
 
         if not no_verify:
             ce.verify_deployment()
+            if not draft and ce.supports_verify_before_activate:
+                # The draft bundle verified successfully, so activate it.
+                ce.activate_deployment().emit_task_log()
 
     return deploy_app
 
@@ -2907,12 +2937,15 @@ def deploy_nodejs(
         image=image,
         env_management_node=env_management_node,
     )
-    ce.deploy_bundle(activate=not draft)
+    ce.deploy_bundle(activate=not ce.should_deploy_as_draft(draft, no_verify))
     ce.save_deployed_info()
     ce.emit_task_log()
 
     if not no_verify:
         ce.verify_deployment()
+        if not draft and ce.supports_verify_before_activate:
+            # The draft bundle verified successfully, so activate it.
+            ce.activate_deployment().emit_task_log()
 
 
 @deploy.command(