Add guarded pre-production deployment script

2026-09-15 20:29:43 +02:00
parent d1bb184b17
commit 39af9ecdb4
2 changed files with 88 additions and 8 deletions
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+trap 'status=$?; printf "FEHLER: Deployment in Zeile %s abgebrochen (Exit %s).\n" "$LINENO" "$status" >&2' ERR
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+REPO_ROOT="$(cd -- "${SCRIPT_DIR}/.." && pwd -P)"
+cd -- "$REPO_ROOT"
+
+if ! TOP_LEVEL="$(git rev-parse --show-toplevel 2>/dev/null)" || [[ "$(cd -- "$TOP_LEVEL" && pwd -P)" != "$REPO_ROOT" ]]; then
+    printf 'FEHLER: %s liegt nicht in einem Git-Repository-Checkout.\n' "$REPO_ROOT" >&2
+    exit 1
+fi
+
+BRANCH="$(git branch --show-current)"
+if [[ "$BRANCH" != "main" ]]; then
+    printf 'FEHLER: Deployment ist nur von Branch main erlaubt (aktuell: %s).\n' "${BRANCH:-unbekannt}" >&2
+    exit 1
+fi
+
+if [[ -n "$(git status --porcelain --untracked-files=all)" ]]; then
+    printf 'FEHLER: Working Tree ist nicht sauber. Änderungen zuerst committen oder entfernen.\n' >&2
+    exit 1
+fi
+
+printf 'Aktualisiere main mit Fast-Forward ...\n'
+git pull --ff-only origin main
+
+compose() {
+    sudo docker compose -f compose.yml -f compose.preprod.yml "$@"
+}
+
+run_preflight() {
+    local output
+    output="$("$@" python push_preflight.py \
+        --expected-service-account metalcircle-push-preprod@metalcircle-30d9b.iam.gserviceaccount.com)"
+    printf '%s\n' "$output"
+    if [[ "$output" != PASS:* ]]; then
+        printf 'FEHLER: Push-Preflight hat kein PASS geliefert.\n' >&2
+        return 1
+    fi
+}
+
+printf 'Prüfe Pre-Production-Compose-Konfiguration ...\n'
+compose config --quiet
+
+printf 'Baue Web-Image ...\n'
+compose build web
+
+printf 'Prüfe Firebase-Credential im temporären Container ...\n'
+run_preflight compose run --rm --no-deps web
+
+printf 'Aktualisiere ausschließlich den Webcontainer ...\n'
+compose up -d --no-deps web
+
+printf 'Prüfe Firebase-Credential im laufenden Webcontainer ...\n'
+run_preflight compose exec -T web
+
+printf '\nCompose-Status:\n'
+compose ps
+
+printf '\nWeb-Logs der letzten 2 Minuten (maximal 100 Zeilen):\n'
+compose logs --since=2m --tail=100 --no-color web
+
+printf '\nDeployter Git-Commit:\n'
+git log -1 --format='%h %s'