From 5a24c162cc38836842d54d568332f391c5e3d2ed Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Thu, 16 Jul 2026 22:29:36 -0700
Subject: [PATCH] fix(pipeline): sync bootstrap stack files before guard, not
 after

---
 .woodpecker.yml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/.woodpecker.yml b/.woodpecker.yml
index 7670237..93a2bdf 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -215,13 +215,7 @@ steps:
 
         for STACK in $ALL_STACKS; do
           echo "--- Deploying: $STACK ---"
-          case "$STACK" in
-            traefik|woodpecker|postgresql)
-              echo "  [BOOTSTRAP] $STACK: secrets provisioned, deploy is MANUAL."
-              echo "  Run: bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK"
-              continue ;;
-          esac
-          # Sync flat file or entire folder
+          # Sync files to host first (always, even for bootstrap stacks)
           if [ -d "$STACK" ]; then
             rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
               "$STACK/" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/$STACK/
@@ -229,6 +223,16 @@ steps:
             rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
               "${STACK}.yaml" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/
           fi
+
+          # Bootstrap-tier guard: file synced to host, deploy is MANUAL
+          case "$STACK" in
+            traefik|woodpecker|postgresql)
+              echo "  [BOOTSTRAP] $STACK: file synced. Deploy is MANUAL."
+              echo "  Run: bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK"
+              continue ;;
+          esac
+
+          # Tier 2: auto-deploy
           ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
             "bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \
             && echo "  OK $STACK" || { echo "  FAIL $STACK"; exit 1; }