Harden scratch setup third-party readiness probes

scripts/setup.ps1

@@ -114,6 +114,34 @@ function Get-RunningContainerByService([string]$serviceName) {
     return $null
 }
 
+function Get-ServiceHttpProbeUrl([string]$serviceName, [int]$containerPort, [string]$path = '/') {
+    $containerName = Get-RunningContainerByService $serviceName
+    if (-not $containerName) {
+        return $null
+    }
+
+    $portMapping = docker port $containerName "${containerPort}/tcp" 2>$null | Select-Object -First 1
+    if (-not $portMapping) {
+        return $null
+    }
+
+    $portMapping = $portMapping.Trim()
+    if ($portMapping -notmatch '^(?<host>.+):(?<port>\d+)$') {
+        return $null
+    }
+
+    $probeHost = $Matches.host
+    if ($probeHost -eq '0.0.0.0' -or $probeHost -eq '::') {
+        $probeHost = '127.0.0.1'
+    }
+
+    if (-not $path.StartsWith('/')) {
+        $path = "/$path"
+    }
+
+    return "http://${probeHost}:$($Matches.port)$path"
+}
+
 # ─── 1. Check prerequisites ────────────────────────────────────────────────
 
 function Test-Prerequisites {
@@ -439,6 +467,45 @@ function Start-Platform {
     }
 }
 
+function Test-ExpectedHttpStatus([string]$url, [int[]]$allowedStatusCodes, [int]$timeoutSeconds = 5, [int]$attempts = 6, [int]$retryDelaySeconds = 2) {
+    for ($attempt = 1; $attempt -le $attempts; $attempt++) {
+        $statusCode = $null
+
+        try {
+            $request = [System.Net.WebRequest]::Create($url)
+            $request.Method = 'GET'
+            $request.Timeout = $timeoutSeconds * 1000
+            $response = [System.Net.HttpWebResponse]$request.GetResponse()
+
+            try {
+                $statusCode = [int]$response.StatusCode
+            } finally {
+                $response.Dispose()
+            }
+        } catch [System.Net.WebException] {
+            $webResponse = $_.Exception.Response -as [System.Net.HttpWebResponse]
+            if ($null -ne $webResponse) {
+                try {
+                    $statusCode = [int]$webResponse.StatusCode
+                } finally {
+                    $webResponse.Dispose()
+                }
+            }
+        } catch {
+        }
+
+        if ($null -ne $statusCode -and $allowedStatusCodes -contains $statusCode) {
+            return $statusCode
+        }
+
+        if ($attempt -lt $attempts) {
+            Start-Sleep -Seconds $retryDelaySeconds
+        }
+    }
+
+    return $null
+}
+
 # ─── 8. Smoke test ─────────────────────────────────────────────────────────
 
 function Test-Smoke {
@@ -474,6 +541,24 @@ function Test-Smoke {
         $hasBlockingFailures = $true
     }
 
+    $rustFsUrl = Get-ServiceHttpProbeUrl 'rustfs' 8333 '/'
+    $rustFsStatus = if ($rustFsUrl) { Test-ExpectedHttpStatus $rustFsUrl @(200, 403) } else { $null }
+    if ($null -ne $rustFsStatus) {
+        Write-Ok "RustFS S3 endpoint (HTTP $rustFsStatus)"
+    } else {
+        Write-Fail 'RustFS S3 endpoint did not respond with an expected status (wanted 200/403)'
+        $hasBlockingFailures = $true
+    }
+
+    $registryUrl = Get-ServiceHttpProbeUrl 'registry' 5000 '/v2/'
+    $registryStatus = if ($registryUrl) { Test-ExpectedHttpStatus $registryUrl @(200, 401) } else { $null }
+    if ($null -ne $registryStatus) {
+        Write-Ok "Zot registry endpoint (HTTP $registryStatus)"
+    } else {
+        Write-Fail 'Zot registry endpoint did not respond with an expected status (wanted 200/401)'
+        $hasBlockingFailures = $true
+    }
+
     # Platform container health summary
     Write-Step 'Container health summary'
     Push-Location $ComposeDir

scripts/setup.sh

@@ -43,6 +43,33 @@ fail()  { printf '   \033[0;31m[FAIL]\033[0m %s\n' "$1"; }
 
 has_cmd() { command -v "$1" &>/dev/null; }
 
+get_running_container_by_service() {
+  local service="$1"
+  docker ps --filter "label=com.docker.compose.service=${service}" --format "{{.Names}}" 2>/dev/null | head -n1
+}
+
+service_http_probe_url() {
+  local service="$1"
+  local container_port="$2"
+  local path="${3:-/}"
+  local container mapping host host_port
+
+  container=$(get_running_container_by_service "$service")
+  [[ -z "$container" ]] && return 1
+
+  mapping=$(docker port "$container" "${container_port}/tcp" 2>/dev/null | head -n1)
+  [[ -z "$mapping" ]] && return 1
+
+  host="${mapping%:*}"
+  host_port="${mapping##*:}"
+  if [[ "$host" == "0.0.0.0" || "$host" == "::" ]]; then
+    host="127.0.0.1"
+  fi
+
+  [[ "$path" != /* ]] && path="/$path"
+  printf 'http://%s:%s%s' "$host" "$host_port" "$path"
+}
+
 # ─── 1. Check prerequisites ────────────────────────────────────────────────
 
 check_prerequisites() {
@@ -305,6 +332,27 @@ start_platform() {
   cd "$ROOT"
 }
 
+http_status() {
+  local url="$1"
+  local attempts="${2:-6}"
+  local delay_seconds="${3:-2}"
+  local status=""
+
+  for (( attempt=1; attempt<=attempts; attempt++ )); do
+    status=$(curl -s -o /dev/null --connect-timeout 5 -w '%{http_code}' "$url" 2>/dev/null || true)
+    if [[ -n "$status" && "$status" != "000" ]]; then
+      printf '%s' "$status"
+      return 0
+    fi
+
+    if (( attempt < attempts )); then
+      sleep "$delay_seconds"
+    fi
+  done
+
+  return 0
+}
+
 # ─── 8. Smoke test ─────────────────────────────────────────────────────────
 
 smoke_test() {
@@ -324,6 +372,24 @@ smoke_test() {
     warn 'Valkey not responding'
   fi
 
+  local rustfs_url rustfs_status
+  rustfs_url=$(service_http_probe_url rustfs 8333 / || true)
+  rustfs_status=$(http_status "$rustfs_url")
+  if [[ "$rustfs_status" == "200" || "$rustfs_status" == "403" ]]; then
+    ok "RustFS S3 endpoint (HTTP $rustfs_status)"
+  else
+    warn 'RustFS S3 endpoint did not respond with an expected status (wanted 200/403)'
+  fi
+
+  local registry_url registry_status
+  registry_url=$(service_http_probe_url registry 5000 /v2/ || true)
+  registry_status=$(http_status "$registry_url")
+  if [[ "$registry_status" == "200" || "$registry_status" == "401" ]]; then
+    ok "Zot registry endpoint (HTTP $registry_status)"
+  else
+    warn 'Zot registry endpoint did not respond with an expected status (wanted 200/401)'
+  fi
+
   # Platform container health summary
   step 'Container health summary'
   cd "$COMPOSE_DIR"