From 0e2b5c10fece3c53bb6b7006c4ce39d1bfd61b16 Mon Sep 17 00:00:00 2001 From: type-two Date: Fri, 17 Jul 2026 23:04:05 +1000 Subject: [PATCH] [infra] Stamp the deploy: curl /gutsy/VERSION to see what is actually live MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I shipped a working tree earlier and had to tell John "live matches no commit in the repo" — which is exactly the sentence a deploy should make impossible. deploy.sh now writes the HEAD short-sha to web root as VERSION, and verifies it came back. `curl https://partly.party/gutsy/VERSION` answers "what is online right now" without trusting anyone's memory of the last deploy. The dirty check is scoped to `git status --porcelain -- web/`, not the whole tree, because only web/ ships: editing docs or this script does not make the payload unreproducible, and a stamp that cried wolf on every NOTES edit would get ignored. A dirty payload ships as `-dirty` and says so, loudly, rather than refusing — mid-round lanes need to push a look at something without committing first, and a deploy tool that blocks that will just get bypassed. Co-Authored-By: Claude Fable 5 --- tools/deploy.sh | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/tools/deploy.sh b/tools/deploy.sh index 7c44abc..71a7aba 100755 --- a/tools/deploy.sh +++ b/tools/deploy.sh @@ -43,9 +43,19 @@ bash "$ROOT/tools/qa.sh" > /tmp/gutsy_qa.log 2>&1 || { echo " ✗ QA RED echo " ✓ QA green" echo "[2/4] Syncing web/ to VPS staging (excluding dev harnesses) ..." +COMMIT="$(git -C "$ROOT" rev-parse --short HEAD)" +if [ -n "$(git -C "$ROOT" status --porcelain -- web/)" ]; then + STAMP="$COMMIT-dirty" + echo " ⚠ web/ has uncommitted changes — what ships will match NO commit in the repo" +else + STAMP="$COMMIT" +fi ssh "$VPS" "rm -rf '$STAGING' && mkdir -p '$STAGING'" rsync -az --delete --exclude='.DS_Store' --exclude='dev/' "$ROOT/web/" "$VPS:$STAGING/" -echo " $(ssh "$VPS" "du -sh $STAGING | cut -f1") staged" +# Provenance, curl-able: `curl https://partly.party/gutsy/VERSION` answers "what is actually +# live right now" without trusting anyone's memory of the last deploy. +ssh "$VPS" "printf '%s\n' '$STAMP' > $STAGING/VERSION" +echo " $(ssh "$VPS" "du -sh $STAGING | cut -f1") staged @ $STAMP" echo "[3/4] Replacing container content ..." ssh "$VPS" "docker exec $CONTAINER sh -c 'rm -rf ${REMOTE_WEB_ROOT:?} && mkdir -p ${REMOTE_WEB_ROOT:?}' && docker cp $STAGING/. $CONTAINER:$REMOTE_WEB_ROOT" @@ -71,6 +81,7 @@ check() { # check