12# Ship a commit of this repo to slate and rebuild the forge container there.3# Data in /srv/forge/data is untouched.4#5# deploy/slate/deploy.sh [--force] [<commit>] HEAD by default6#7# What ships is the commit, exported with git archive, never the working8# tree: uncommitted edits, whoever made them, stay here. It needs a9# verified passing CI attestation (forge verify), as main on the forge10# does; --force ships it anyway. The commit deployed is written to11# /srv/forge/src/DEPLOYED.12set -eu13here=$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)14host=${FORGE_HOST:-slate}15force=016[ "${1:-}" = --force ] && { force=1; shift; }17rev=$(git -C "$here" rev-parse --verify "${1:-HEAD}^{commit}")18short=$(git -C "$here" rev-parse --short "$rev")19if ! git -C "$here" diff --quiet HEAD 2>/dev/null; then20 echo "deploy: the working tree has uncommitted changes; they stay here, $short ships" >&221fi22if ! "$here/bin/forge" verify "$rev" >/dev/null 2>&1; then23 [ "$force" = 1 ] || { echo "deploy: $short has no verified passing CI attestation (forge attest $short), or pass --force" >&2; exit 1; }24 echo "deploy: shipping $short without a verified CI pass (--force)" >&225fi26tmp=$(mktemp -d "${TMPDIR:-/tmp}/forge-deploy.XXXXXX")27trap 'rm -rf "$tmp"' EXIT28git -C "$here" archive "$rev" | tar -x -C "$tmp"29printf '%s\n' "$rev" >"$tmp/DEPLOYED"30rsync -a --delete --exclude node_modules --exclude demo/root --exclude demo/work \31 --exclude .env --exclude _site --exclude .cache "$tmp/" "$host:/srv/forge/src/"32ssh "$host" 'cd /srv/forge/src/deploy/slate && docker compose up -d --build'33echo "deploy: $short is on $host"