186 lines
10 KiB
Bash
Executable File
186 lines
10 KiB
Bash
Executable File
#!/bin/bash
|
|
# cayce-autodeploy — r18: despliega main nuevo SIN intervención del operador.
|
|
# ~/cayce-ops → git pull de main (docs, prompts; el despliegue lee el tree)
|
|
# /srv/cayce-core → checkout de cayce/entity main, con PUBLISH_OFF activo
|
|
# durante el swap. Solo se retira si: tests del guard
|
|
# 27+/27 y watcher sin VIOLACION. Rollback automatico.
|
|
# Timer: cada 3 min. Fallo → DM al supervisor + logger. Nunca toca un tree sucio.
|
|
|
|
say() { echo "[autodeploy] $*"; logger -t cayce-autodeploy "$*"; }
|
|
dm() {
|
|
SUP=$(grep -aoE 'SUPERVISOR_NPUB_HEX=[0-9a-f]+' /srv/cayce-nostr/.env 2>/dev/null | cut -d= -f2)
|
|
[ -n "$SUP" ] && curl -s -X POST http://127.0.0.1:3011/dm -H "Content-Type: application/json" \
|
|
-d "{\"to_hex\":\"$SUP\",\"content\":\"AUTODEPLOY: $1\"}" >/dev/null 2>&1
|
|
}
|
|
|
|
# r31 (S1): lock compartido con cayce-auto-merge — nunca compiten sobre los
|
|
# mismos arboles/branches (incidente 02:06:29Z del 2026-11-03: un rollback
|
|
# `git reset --hard $OLD` pisó una rama de trabajo porque el árbol cambió de
|
|
# branch a mitad de deploy). Las ops manuales con git sobre /srv/* tambien
|
|
# lo toman: flock /run/lock/cayce-git-ops.lock <comando>
|
|
LOCK=/run/lock/cayce-git-ops.lock
|
|
exec 9>"$LOCK" || { say 'FATAL: no se puede abrir lockfile'; exit 1; }
|
|
if ! flock -n 9; then
|
|
say "auto-merge (u otra op) mantiene el lock — paso de este ciclo"
|
|
exit 0
|
|
fi
|
|
|
|
# ── 1. cayce-ops (main) ──────────────────────────────────────────────────────
|
|
cd /home/ubuntu/cayce-ops || { say "FATAL: sin ~/cayce-ops"; exit 1; }
|
|
git fetch -q origin 2>/dev/null
|
|
if [ "$(git branch --show-current)" = "main" ] && ! git merge-base --is-ancestor origin/main HEAD 2>/dev/null; then
|
|
if [ -n "$(git status --porcelain)" ]; then
|
|
say "ABORT: cayce-ops tree sucio"; dm "abortado: cayce-ops dirty"
|
|
elif git pull -q --ff-only origin main; then
|
|
say "cayce-ops → $(git rev-parse --short HEAD)"
|
|
# r21: sin DM (no urgente) — dm "cayce-ops actualizado a $(git rev-parse --short HEAD)"
|
|
else
|
|
say "ERROR: pull cayce-ops"; dm "error pull cayce-ops"
|
|
fi
|
|
fi
|
|
|
|
# ── 2. entity → /srv/cayce-core (con regla de urgencia) ──────────────────────
|
|
cd /srv/cayce-core || { say "FATAL: sin /srv/cayce-core"; exit 1; }
|
|
git fetch -q origin 2>/dev/null
|
|
# desplegar solo si main tiene commits que NO estan en el checkout
|
|
# r20: sin exit 0 — mataba el script y la sección bitcoinhotels nunca corría
|
|
if ! git merge-base --is-ancestor origin/main HEAD 2>/dev/null; then
|
|
# r25: lessons.md lo muta el ciclo retro en produccion — preservar (stash/pop).
|
|
# Cualquier OTRO fichero sucio si aborta.
|
|
DIRTY_OTHER=$(git status --porcelain | grep -v " lessons.md" | head -3)
|
|
if [ -n "$DIRTY_OTHER" ]; then
|
|
say "ABORT: /srv/cayce-core tree sucio: $DIRTY_OTHER"; dm "abortado: /srv/cayce-core dirty ($DIRTY_OTHER) — deploy pendiente"
|
|
exit 1
|
|
fi
|
|
git stash push -q -m "autodeploy-lessons" -- lessons.md 2>/dev/null || true
|
|
|
|
OLD=$(git rev-parse HEAD)
|
|
echo "autodeploy $(date -u +%FT%TZ)" > PUBLISH_OFF # r21: firmado para que urgent-watch no lo tome por manual
|
|
say "main nuevo detectado: $(git rev-parse --short HEAD) → $(git rev-parse --short origin/main) (PUBLISH_OFF activo)"
|
|
|
|
if ! git checkout -q main || ! git reset -q --hard origin/main; then
|
|
git reset -q --hard "$OLD" 2>/dev/null; rm -f PUBLISH_OFF
|
|
say "FATAL: checkout entity"; dm "FATAL checkout entity — deploy cancelado, sin cambios"
|
|
exit 1
|
|
fi
|
|
|
|
# verificación 1: tests del guard
|
|
OUT=$(cd /srv/cayce-core && node --test guard.test.mjs 2>&1)
|
|
PASS=$(echo "$OUT" | grep -c '^ok ')
|
|
FAIL=$(echo "$OUT" | grep -c '^not ok ')
|
|
if [ "$FAIL" != "0" ] || [ "$PASS" -lt 27 ]; then
|
|
git reset -q --hard "$OLD"
|
|
git stash pop -q 2>/dev/null || true
|
|
say "ROLLBACK: tests $PASS ok / $FAIL fail (<27 o fail>0)"
|
|
dm "ROLLBACK en deploy entity: tests $PASS/$FAIL. main NO desplegado; runtime en $(git rev-parse --short HEAD)"
|
|
exit 1
|
|
fi
|
|
|
|
# verificación 2: daemon + watcher limpio
|
|
sudo -n systemctl restart cayce-nostr.service
|
|
sudo -n systemctl start cayce-relay-watcher.service
|
|
W=0
|
|
for i in 1 2 3 4 5 6; do
|
|
sleep 5
|
|
[ "$(systemctl is-active cayce-relay-watcher.service)" = "inactive" ] && break
|
|
done
|
|
if systemctl is-failed cayce-relay-watcher.service >/dev/null 2>&1 \
|
|
|| journalctl -u cayce-relay-watcher -n 8 --no-pager 2>/dev/null | grep -q VIOLACION; then
|
|
git reset -q --hard "$OLD"
|
|
sudo -n systemctl restart cayce-nostr.service
|
|
say "ROLLBACK: watcher con VIOLACION — PUBLISH_OFF queda ACTIVO"
|
|
dm "ROLLBACK watcher en deploy entity. PUBLISH_OFF QUEDA ACTIVO — revision manual"
|
|
exit 1 # ojo: PUBLISH_OFF se queda (fail-safe deliberado)
|
|
fi
|
|
|
|
rm -f PUBLISH_OFF
|
|
git stash pop -q 2>/dev/null || true # lessons.md del ciclo retro
|
|
say "entity → $(git rev-parse --short HEAD) (tests $PASS/27, watcher OK, live)"
|
|
# r21: sin DM (no urgente) — dm "entity desplegado: $(git rev-parse --short HEAD) — tests $PASS/27, watcher OK"
|
|
fi # fin sección entity
|
|
|
|
# r32: la seccion hardcap corre en SUBSHELL — un ROLLBACK (exit 1) ya no
|
|
# aborta los deploys de bitcoinhotels (bug: rollback de hardcap llevaba
|
|
# bloqueando bh desde las 15:10 mientras gh#10 espera merge)
|
|
(
|
|
# ── 2b. hardcap-news → /srv/hardcap-news (GitHub; web, sin PUBLISH_OFF) ─────
|
|
cd /srv/hardcap-news || { say "FATAL: sin /srv/hardcap-news"; exit 1; }
|
|
git fetch -q origin 2>/dev/null
|
|
if ! git merge-base --is-ancestor origin/main HEAD 2>/dev/null && [ -z "$(git status --porcelain)" ]; then
|
|
OLD=$(git rev-parse HEAD)
|
|
if ! git checkout -q main || ! git reset -q --hard origin/main; then
|
|
git reset -q --hard "$OLD" 2>/dev/null; say "FATAL: checkout hardcap-news"; exit 1
|
|
fi
|
|
if git diff --name-only "$OLD" HEAD 2>/dev/null | grep -q "^frontend/package-lock.json$"; then
|
|
(cd frontend && npm ci --ignore-scripts >/dev/null 2>&1) || say "WARN: npm ci hardcap"
|
|
fi
|
|
if ! (cd frontend && npm run build >/tmp/hc-autodeploy-build.log 2>&1); then
|
|
git reset -q --hard "$OLD"; (cd frontend && npm run build >/dev/null 2>&1); sudo -n systemctl restart hardcap-frontend.service
|
|
say "ROLLBACK hardcap-news: fallo el build"; dm "ROLLBACK hardcap-news (build) — main NO desplegado, rollback activo"
|
|
exit 1
|
|
fi
|
|
sudo -n systemctl restart hardcap-frontend.service
|
|
sleep 6
|
|
CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:3003/)
|
|
if [ "$CODE" != "200" ]; then
|
|
git reset -q --hard "$OLD"; (cd frontend && npm run build >/dev/null 2>&1); sudo -n systemctl restart hardcap-frontend.service
|
|
say "ROLLBACK hardcap-news: verificacion (code=$CODE)"; dm "ROLLBACK hardcap-news verificacion: code=$CODE — rollback activo"
|
|
exit 1
|
|
fi
|
|
# r24: identidad por build-id (cuando el despliegue trae la función)
|
|
if git grep -q "NEXT_PUBLIC_BUILD_ID" -- frontend/src/app/layout.tsx frontend/next.config.js 2>/dev/null; then
|
|
BUILT=$(curl -s -m 8 http://127.0.0.1:3003/ | grep -oE 'name="build-id" content="[a-f0-9]{8}"' | grep -oE '[a-f0-9]{8}' | head -1)
|
|
WANT=$(git rev-parse --short=8 HEAD)
|
|
if [ "$BUILT" != "$WANT" ]; then
|
|
git reset -q --hard "$OLD"; (cd frontend && npm run build >/dev/null 2>&1); sudo -n systemctl restart hardcap-frontend.service
|
|
say "ROLLBACK hardcap-news: build-id '$BUILT' != '$WANT'"; dm "ROLLBACK hardcap-news: servia build '$BUILT' pero lo desplegado era '$WANT'."
|
|
exit 1
|
|
fi
|
|
say "identidad hardcap OK: servido=$BUILT desplegado=$WANT"
|
|
fi
|
|
say "hardcap-news → $(git rev-parse --short HEAD) (200)"
|
|
fi
|
|
|
|
)
|
|
# ── 3. bitcoinhotels → /srv/bitcoinhotels (web; sin PUBLISH_OFF) ────────────
|
|
cd /srv/bitcoinhotels || { say "FATAL: sin /srv/bitcoinhotels"; exit 1; }
|
|
git fetch -q origin 2>/dev/null
|
|
if ! git merge-base --is-ancestor origin/main HEAD 2>/dev/null && [ -z "$(git status --porcelain)" ]; then
|
|
OLD=$(git rev-parse HEAD)
|
|
if ! git checkout -q main || ! git reset -q --hard origin/main; then
|
|
git reset -q --hard "$OLD" 2>/dev/null; say "FATAL: checkout bitcoinhotels"; dm "FATAL checkout bitcoinhotels — sin cambios"; exit 1
|
|
fi
|
|
if git diff --name-only "$OLD" HEAD 2>/dev/null | grep -q "^package-lock.json$"; then
|
|
npm ci --ignore-scripts >/dev/null 2>&1 || { say "WARN: npm ci bitcoinhotels"; }
|
|
fi
|
|
if ! npm run build >/tmp/bh-autodeploy-build.log 2>&1; then
|
|
git reset -q --hard "$OLD"; npm run build >/dev/null 2>&1; systemctl restart cayce-bitcoinhotels
|
|
say "ROLLBACK bitcoinhotels: fallo el build"; dm "ROLLBACK bitcoinhotels (build) — main NO desplegado, rollback activo"
|
|
exit 1
|
|
fi
|
|
sudo -n systemctl restart cayce-bitcoinhotels
|
|
sleep 6
|
|
CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:3002/)
|
|
UMAMI=$(curl -s http://127.0.0.1:3002/ | grep -c umami)
|
|
MARCAS=$(curl -s http://127.0.0.1:3002/guides/how-to-pay-with-lightning-abroad | grep -cE "Trezor|Ledger|BitBox|Coldcard")
|
|
if [ "$CODE" != "200" ] || [ "$UMAMI" = "0" ] || [ "$MARCAS" != "0" ]; then
|
|
git reset -q --hard "$OLD"; npm run build >/dev/null 2>&1; systemctl restart cayce-bitcoinhotels
|
|
say "ROLLBACK bitcoinhotels: verificacion (code=$CODE umami=$UMAMI marcas=$MARCAS)"
|
|
dm "ROLLBACK bitcoinhotels verificacion: code=$CODE umami=$UMAMI marcas=$MARCAS — rollback activo"
|
|
exit 1
|
|
fi
|
|
say "bitcoinhotels → $(git rev-parse --short HEAD) (200 + umami + 0 marcas)"
|
|
# r22: verificación de IDENTIDAD — lo servido debe ser lo desplegado
|
|
if git grep -q "NEXT_PUBLIC_BUILD_ID" -- src/app/layout.tsx 2>/dev/null; then
|
|
BUILT=$(curl -s -m 8 http://127.0.0.1:3002/ | grep -oE 'name="build-id" content="[a-f0-9]{8}"' | grep -oE '[a-f0-9]{8}' | head -1)
|
|
WANT=$(git rev-parse --short=8 HEAD)
|
|
if [ "$BUILT" != "$WANT" ]; then
|
|
git reset -q --hard "$OLD"; npm run build >/dev/null 2>&1; sudo -n systemctl restart cayce-bitcoinhotels
|
|
say "ROLLBACK bitcoinhotels: build-id servido '$BUILT' != desplegado '$WANT'"
|
|
dm "ROLLBACK bitcoinhotels: el sitio servia build '$BUILT' pero lo desplegado era '$WANT' — rollback activo."
|
|
exit 1
|
|
fi
|
|
say "identidad OK: servido=$BUILT desplegado=$WANT"
|
|
fi
|
|
fi
|