`verification/TK-11380/deploy-remote.sh`

78 lines
#!/usr/bin/env bash
set -euo pipefail
APP=/root/Projects/iwascute
RUN=TK11380-20260910T172500Z
STATE=/root/.local/state/iwascute-deploy/$RUN
STAGE=/root/Projects/.iwascute-$RUN
PATCH=/tmp/TK11380-iwascute.patch
cd "$APP"
if [[ "${1:-}" == prepare || "${1:-}" == activate ]]; then
  test "$(date +%s)" -lt 1789118350 || { echo 'AdSense approval window expired' >&2; exit 3; }
fi
recover() {
  trap - ERR
  pm2 stop gap-iwascute > "$STATE/recovery-stop.log" 2>&1 || true
  for part in .next node_modules; do
    local previous="$STATE/previous.${part#.}"
    if [[ -d "$previous" ]]; then
      if [[ -e "$APP/$part" ]]; then mv "$APP/$part" "$STATE/failed.${part#.}"; fi
      mv "$previous" "$APP/$part"
    fi
  done
  if git apply -R --check "$PATCH"; then git apply -R "$PATCH"; fi
  pm2 restart gap-iwascute > "$STATE/recovery-start.log" 2>&1
  printf 'ROLLED_BACK %s\n' "$STATE"
}
case "${1:-}" in
  prepare)
    test ! -e "$STATE"
    test ! -e "$STAGE"
    git apply --check "$PATCH"
    nginx -t
    install -d -m 700 "$STATE" "$STAGE"
    git status --short > "$STATE/before-status.txt"
    git rev-parse HEAD > "$STATE/before-head.txt"
    sha256sum src/app/layout.tsx src/app/api/admin/route.ts > "$STATE/before-sha256.txt"
    rsync -a --exclude=.git --exclude=.next --exclude=node_modules ./ "$STATE/source/"
    # Only reviewed non-secret files enter the existing Git repository.
    git add -- .gitignore package.json package-lock.json src/app/layout.tsx public/ads.txt
    git -c user.name='Steve Abrams' -c user.email=steve@designerwallcoverings.com commit -m 'snapshot before TK-11380 IWasCute targeted deployment'
    git rev-parse HEAD > "$STATE/snapshot-head.txt"
    rsync -a --exclude=.git --exclude=.next --exclude=node_modules ./ "$STAGE/"
    cd "$STAGE"
    git apply --check "$PATCH"
    git apply "$PATCH"
    npm ci --ignore-scripts --no-audit --no-fund > "$STATE/install.log" 2>&1
    NEXT_TELEMETRY_DISABLED=1 npm run build > "$STATE/build.log" 2>&1
    node /tmp/TK11380-iwascute-normalize.cjs "$STAGE" > "$STATE/normalized-links.json"
    test -s .next/BUILD_ID
    cat .next/BUILD_ID > "$STATE/new-build-id.txt"
    printf 'PREPARED %s\n' "$STATE"
    ;;
  activate)
    test -s "$STATE/new-build-id.txt"
    test ! -e "$STATE/previous.next"
    test ! -e "$STATE/previous.node_modules"
    sha256sum --check "$STATE/before-sha256.txt"
    git apply --check "$PATCH"
    git apply "$PATCH"
    trap 'recover; exit 1' ERR
    pm2 stop gap-iwascute > "$STATE/activation-stop.log" 2>&1
    mv .next "$STATE/previous.next"
    mv node_modules "$STATE/previous.node_modules"
    mv "$STAGE/.next" .next
    mv "$STAGE/node_modules" node_modules
    pm2 restart gap-iwascute > "$STATE/activation-start.log" 2>&1
    sleep 1
    node /tmp/TK11380-iwascute-http.cjs http://127.0.0.1:9636 > "$STATE/post-activation-http.json"
    trap - ERR
    printf 'ACTIVATED %s\n' "$STATE"
    ;;
  rollback)
    test -d "$STATE/previous.next"
    test -d "$STATE/previous.node_modules"
    recover
    ;;
  *) echo 'Expected prepare, activate or rollback' >&2; exit 2 ;;
esac