193 lines
6.9 KiB
Bash
Executable File
193 lines
6.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
umask 077
|
|
|
|
ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
|
|
action=${1:-plan}
|
|
ssh_target=${2:-whoneedhelp}
|
|
remote_root=${WNH_TEST_REMOTE_ROOT:-/srv/who_need_help-test}
|
|
production_root=${WNH_PRODUCTION_REMOTE_ROOT:-/srv/who_need_help-production}
|
|
expected_domain=${WNH_TEST_DOMAIN:-test.whoneedhelp.com}
|
|
|
|
case "$action" in
|
|
plan | prepare | apply) ;;
|
|
*)
|
|
echo "Usage: $0 [plan|prepare|apply] [SSH_TARGET]" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
|
|
for command in git gzip mktemp pg_restore realpath scp sha256sum ssh; do
|
|
command -v "$command" >/dev/null 2>&1 || {
|
|
echo "Required command is unavailable: $command" >&2
|
|
exit 2
|
|
}
|
|
done
|
|
|
|
local_commit=$(git -C "$ROOT" rev-parse --verify HEAD)
|
|
remote_commit=$(
|
|
ssh -o BatchMode=yes "$ssh_target" \
|
|
"git -C '$remote_root' rev-parse --verify HEAD"
|
|
)
|
|
|
|
printf 'Local candidate commit: %s\n' "$local_commit"
|
|
printf 'Current test commit: %s\n' "$remote_commit"
|
|
|
|
git -C "$ROOT" cat-file -e "$remote_commit^{commit}" 2>/dev/null || {
|
|
echo "The test commit is not present in the local object database." >&2
|
|
exit 2
|
|
}
|
|
git -C "$ROOT" merge-base --is-ancestor "$remote_commit" "$local_commit" || {
|
|
echo "The local candidate is not a fast-forward from the test commit." >&2
|
|
exit 2
|
|
}
|
|
printf 'Pending commits: %s\n' \
|
|
"$(git -C "$ROOT" rev-list --count "$remote_commit..$local_commit")"
|
|
|
|
legacy_edge_paths=(compose.edge.yaml deploy/caddy/Caddyfile)
|
|
if ! git -C "$ROOT" diff --quiet \
|
|
"$remote_commit" "$local_commit" -- "${legacy_edge_paths[@]}"; then
|
|
echo "The test application release contains shared edge routing changes." >&2
|
|
echo "Move route changes through the independent server-edge workflow." >&2
|
|
exit 2
|
|
fi
|
|
echo "Shared edge routing files are unchanged; the test release will not manage Caddy."
|
|
|
|
migration_policy_output=$(
|
|
"$ROOT/scripts/release-migration-policy.sh" "$remote_commit" "$local_commit"
|
|
)
|
|
printf '%s\n' "$migration_policy_output"
|
|
migration_policy=$(awk -F= '$1 == "migration_policy" {print $2}' <<<"$migration_policy_output")
|
|
|
|
plan_failed=0
|
|
if ! ssh -o BatchMode=yes "$ssh_target" \
|
|
"cd '$remote_root' && ./scripts/validate-test-env.sh .env '$expected_domain'"; then
|
|
plan_failed=1
|
|
fi
|
|
if ! ssh -o BatchMode=yes "$ssh_target" \
|
|
"cd '$remote_root' && ./scripts/validate-deployment-isolation.sh '$remote_root' '$production_root'"; then
|
|
plan_failed=1
|
|
fi
|
|
if ! ssh -o BatchMode=yes "$ssh_target" \
|
|
"bash -s -- plan '$remote_root' '$expected_domain'" \
|
|
<"$ROOT/scripts/test-release-remote.sh"; then
|
|
plan_failed=1
|
|
fi
|
|
if ! ssh -o BatchMode=yes "$ssh_target" \
|
|
"cd '$remote_root' && ./scripts/check-environment-readiness.sh .env --require-server-release"; then
|
|
plan_failed=1
|
|
fi
|
|
|
|
if [[ "$plan_failed" -ne 0 ]]; then
|
|
echo "Test release plan has blocking checks; no remote state was changed." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$action" == plan ]]; then
|
|
echo "Test release plan passed; no remote state was changed."
|
|
exit 0
|
|
fi
|
|
|
|
[[ -z "$(git -C "$ROOT" status --porcelain --untracked-files=normal)" ]] || {
|
|
echo "Refusing to release a dirty checkout." >&2
|
|
exit 2
|
|
}
|
|
|
|
artifact_root=${WNH_TEST_RELEASE_ARTIFACT_ROOT:-"$ROOT/output/test-releases"}
|
|
case "$artifact_root" in
|
|
/*) ;;
|
|
*)
|
|
echo "WNH_TEST_RELEASE_ARTIFACT_ROOT must be an absolute path." >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
mkdir -p "$artifact_root"
|
|
artifact_root=$(realpath --canonicalize-existing "$artifact_root")
|
|
|
|
WNH_PRODUCTION_RELEASE_ARTIFACT_ROOT="$artifact_root" \
|
|
"$ROOT/scripts/prepare-production-release.sh"
|
|
release_dir="$artifact_root/$local_commit"
|
|
bundle="$release_dir/who_need_help-$local_commit.bundle"
|
|
image_archive="$release_dir/who_need_help-$local_commit-test-images-linux-amd64.tar.gz"
|
|
image_checksum="$image_archive.sha256"
|
|
image_manifest="$release_dir/who_need_help-$local_commit-test-images.manifest"
|
|
|
|
test_env=$(mktemp)
|
|
cleanup_test_env() {
|
|
trap - EXIT HUP INT TERM
|
|
rm -f "$test_env"
|
|
}
|
|
trap cleanup_test_env EXIT HUP INT TERM
|
|
scp -p "$ssh_target:$remote_root/.env" "$test_env"
|
|
chmod 600 "$test_env"
|
|
WNH_TEST_RELEASE_ARTIFACT_ROOT="$artifact_root" \
|
|
"$ROOT/scripts/prepare-test-images.sh" "$test_env"
|
|
cleanup_test_env
|
|
|
|
if [[ "$action" == prepare ]]; then
|
|
echo "Test release artifacts are prepared and verified locally; no remote state was changed."
|
|
exit 0
|
|
fi
|
|
|
|
remote_main=$(git -C "$ROOT" ls-remote origin refs/heads/main | awk '{print $1}')
|
|
[[ "$remote_main" == "$local_commit" ]] || {
|
|
echo "origin/main does not contain the exact approved test candidate." >&2
|
|
echo "Expected: $local_commit" >&2
|
|
echo "Observed: ${remote_main:-missing}" >&2
|
|
exit 2
|
|
}
|
|
|
|
confirmation="$expected_domain:$local_commit"
|
|
[[ "${WNH_TEST_RELEASE_CONFIRM:-}" == "$confirmation" ]] || {
|
|
echo "Test release execution requires exact approval:" >&2
|
|
echo "WNH_TEST_RELEASE_CONFIRM=$confirmation $0 apply $ssh_target" >&2
|
|
exit 2
|
|
}
|
|
if [[ "$migration_policy" == forward_only ]]; then
|
|
forward_confirmation="$expected_domain:$local_commit:forward-only"
|
|
[[ "${WNH_TEST_FORWARD_ONLY_CONFIRM:-}" == "$forward_confirmation" ]] || {
|
|
echo "This test release contains forward-only migrations." >&2
|
|
echo "WNH_TEST_FORWARD_ONLY_CONFIRM=$forward_confirmation \\" >&2
|
|
echo " WNH_TEST_RELEASE_CONFIRM=$confirmation $0 apply $ssh_target" >&2
|
|
exit 2
|
|
}
|
|
fi
|
|
|
|
remote_release_dir="$remote_root/output/releases/incoming"
|
|
remote_bundle="$remote_release_dir/$(basename -- "$bundle")"
|
|
remote_image_archive="$remote_release_dir/$(basename -- "$image_archive")"
|
|
remote_image_manifest="$remote_release_dir/$(basename -- "$image_manifest")"
|
|
timestamp=$(date -u +%Y%m%dT%H%M%SZ)
|
|
remote_backup="$remote_root/output/backups/test/pre-$timestamp-${local_commit:0:12}.dump"
|
|
|
|
ssh -o BatchMode=yes "$ssh_target" "install -d -m 700 '$remote_release_dir'"
|
|
scp -p \
|
|
"$bundle" "$bundle.sha256" \
|
|
"$image_archive" "$image_checksum" "$image_manifest" \
|
|
"$ssh_target:$remote_release_dir/"
|
|
|
|
ssh -o BatchMode=yes "$ssh_target" \
|
|
"cd '$remote_root' && ./scripts/backup-compose.sh '$remote_backup'"
|
|
|
|
local_backup_dir="$ROOT/output/test-backups/$timestamp-${local_commit:0:12}"
|
|
mkdir -p "$local_backup_dir"
|
|
chmod 700 "$ROOT/output" "$ROOT/output/test-backups" "$local_backup_dir"
|
|
scp -p \
|
|
"$ssh_target:$remote_backup" \
|
|
"$ssh_target:$remote_backup.sha256" \
|
|
"$local_backup_dir/"
|
|
(
|
|
cd "$local_backup_dir"
|
|
sha256sum --check "$(basename -- "$remote_backup.sha256")" >/dev/null
|
|
)
|
|
pg_restore --list "$local_backup_dir/$(basename -- "$remote_backup")" >/dev/null
|
|
echo "Copied and independently verified the pre-release test backup outside the server."
|
|
|
|
quoted_confirmation=$(printf '%q' "$confirmation")
|
|
quoted_forward_confirmation=$(printf '%q' "${WNH_TEST_FORWARD_ONLY_CONFIRM:-}")
|
|
ssh -o BatchMode=yes "$ssh_target" \
|
|
"WNH_TEST_RELEASE_CONFIRM=$quoted_confirmation WNH_TEST_FORWARD_ONLY_CONFIRM=$quoted_forward_confirmation bash -s -- apply '$remote_root' '$expected_domain' '$remote_bundle' '$local_commit' '$remote_backup' '$migration_policy' '$remote_image_archive' '$remote_image_manifest'" \
|
|
<"$ROOT/scripts/test-release-remote.sh"
|
|
|
|
echo "Test release and public health verification completed."
|