Add: git-guard.sh - pre-deploy sync check to prevent local/Gitea divergence

2026-08-26 22:30:47 -07:00
parent 7b5273b4b4
commit 0bc117c868
1 changed files with 142 additions and 0 deletions
@@ -0,0 +1,142 @@
 #!/usr/bin/env bash
 # git-guard.sh — Ensures the compose-files working tree is in sync with Gitea
 # before any deploy proceeds. Called automatically by stack-deploy.sh.
 #
 # Behavior:
 #   - Clean + up to date        -> pass silently
 #   - Clean + behind (ff-only)  -> auto `git pull --ff-only`, then pass
 #   - Ahead only (unpushed)     -> interactive: offer to push; non-interactive: BLOCK
 #   - Dirty tracked changes     -> offer to commit + push right now
 #                                   (auto in non-interactive/CI runs, after a
 #                                   secret-pattern scan of the staged diff)
 #   - Diverged (local AND       -> REFUSE. Never auto-resolves. Prints the
 #     remote both moved)           backup/stash/reset recovery steps and exits.
 #
 # Exit codes: 0 = safe to deploy, 1 = blocked, needs human intervention
 set -euo pipefail
 DIR="/volume1/docker/compose-files"
 cd "$DIR"
 # Non-interactive detection (Woodpecker/cron have no TTY on stdin)
 INTERACTIVE=0
 [ -t 0 ] && INTERACTIVE=1
 echo "==> git-guard: checking repo sync state"
 git fetch origin --quiet
 LOCAL="$(git rev-parse main)"
 REMOTE="$(git rev-parse origin/main)"
 BASE="$(git merge-base main origin/main)"
 DIRTY=0
 git status --porcelain | grep -q . && DIRTY=1
 SECRET_PATTERN='(-----BEGIN [A-Z]+ PRIVATE KEY-----|AKIA[0-9A-Z]{16}|xox[baprs]-[0-9a-zA-Z-]+|password[[:space:]]*[:=][[:space:]]*[^$ ]|api[_-]?key[[:space:]]*[:=][[:space:]]*[^$ ])'
 # ---- Case: dirty tracked changes ----
 if [ "$DIRTY" -eq 1 ]; then
  echo "!! WORKING TREE DIRTY — uncommitted changes detected:"
  git status --short
  echo
  if [ "$INTERACTIVE" -eq 1 ]; then
    read -rp "Commit and push these changes to origin/main now? [y/N] " ans
  else
    ans="y"
    echo "(non-interactive session — auto-committing and pushing)"
  fi
  if [[ "$ans" =~ ^[Yy]$ ]]; then
    git add -A
    if git diff --cached | grep -Eiq "$SECRET_PATTERN"; then
      echo "ERROR: possible secret detected in staged changes. Refusing to auto-commit."
      echo "Review manually: git diff --cached"
      git reset
      exit 1
    fi
    git commit -m "chore(auto): git-guard autofix - commit local changes before deploy $(date -u +%Y-%m-%dT%H:%M:%SZ)"
    if git push origin main; then
      echo "==> Pushed. Re-checking sync state..."
      exec "$0" "$@"
    else
      echo "ERROR: push failed (likely diverged from origin). Aborting deploy."
      echo "Run: cd $DIR && git status"
      exit 1
    fi
  else
    echo "Aborting deploy - commit or stash changes manually, then retry."
    exit 1
  fi
 fi
 # ---- Case: fully in sync ----
 if [ "$LOCAL" = "$REMOTE" ]; then
  echo "==> In sync with origin/main ($LOCAL). OK to deploy."
  exit 0
 fi
 # ---- Case: behind only (fast-forwardable) ----
 if [ "$LOCAL" = "$BASE" ]; then
  echo "!! Local main is behind origin/main."
  if [ "$INTERACTIVE" -eq 1 ]; then
    read -rp "Fast-forward pull now? [y/N] " ans
  else
    ans="y"
    echo "(non-interactive session — auto fast-forwarding)"
  fi
  if [[ "$ans" =~ ^[Yy]$ ]]; then
    git pull --ff-only origin main
    echo "==> Fast-forwarded to $(git rev-parse --short main). OK to deploy."
    exit 0
  else
    echo "Aborting deploy - pull manually, then retry."
    exit 1
  fi
 fi
 # ---- Case: ahead only (local commits not yet pushed) ----
 if [ "$REMOTE" = "$BASE" ]; then
  echo "!! Local main is AHEAD of origin/main (unpushed commits):"
  git log --oneline "origin/main..main"
  echo
  if [ "$INTERACTIVE" -eq 1 ]; then
    read -rp "Push local commits to origin/main now? [y/N] " ans
  else
    ans="n"
    echo "(non-interactive session — will NOT auto-push ahead commits; needs human review)"
  fi
  if [[ "$ans" =~ ^[Yy]$ ]]; then
    git push origin main
    echo "==> Pushed. OK to deploy."
    exit 0
  else
    echo "Aborting deploy. Review with: git log origin/main..main"
    exit 1
  fi
 fi
 # ---- Case: true divergence (both ahead and behind) — NEVER auto-fix ----
 echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
 echo "!! DIVERGED: local main and origin/main have both moved independently."
 echo "!!"
 echo "!!   Local-only commits:"
 git log --oneline "$BASE..main" | sed 's/^/!!     /'
 echo "!!"
 echo "!!   Remote-only commits:"
 git log --oneline "$BASE..origin/main" | sed 's/^/!!     /'
 echo "!!"
 echo "!! This requires a human decision - git-guard will NOT auto-resolve this."
 echo "!! Recommended recovery:"
 echo "!!   1. tar backup:      tar czf /volume1/docker/compose-files-backup-\$(date +%Y%m%d-%H%M%S).tar.gz -C /volume1/docker compose-files"
 echo "!!   2. name the branch: git branch backup/pre-reset-\$(date +%Y%m%d)"
 echo "!!   3. stash all state: git stash push -u -m 'pre-reset-snapshot'"
 echo "!!   4. reset to origin: git reset --hard origin/main"
 echo "!!   5. selectively restore needed files from the stash/backup branch"
 echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
 exit 1