#!/usr/bin/env bash
# Invoked by ci-jvm only after tests, production smoke and manifest creation.
set -euo pipefail
root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
cd "$root"
if [[ ${WERKJOURNAL_CI_DEPLOY:-0} != 1 ]]; then
  echo 'Automatic deployment disabled outside the configured CI job.'
  exit 0
fi
if [[ ${branch:-} != main ]]; then
  echo 'Automatic deployment only runs for the main branch.'
  exit 0
fi
# Werkator binds this repository's persistent build home as /root in Werkdock.
export WERKJOURNAL_DEPLOY_KEY="${HOME}/.ssh/werkjournal_deploy"
export WERKJOURNAL_DEPLOY_HOST_KEYS="${HOME}/.ssh/werkjournal_known_hosts"
test -s "$WERKJOURNAL_DEPLOY_KEY"
test -s "$WERKJOURNAL_DEPLOY_HOST_KEYS"
git diff --quiet HEAD -- .
python3 - <<'PY'
import json, subprocess
from pathlib import Path
manifest = json.loads(Path('build/release/manifest.json').read_text())
head = subprocess.check_output(['git', 'rev-parse', 'HEAD'], text=True).strip()
if manifest['commit'] != head:
    raise SystemExit('Release manifest does not match this build checkout')
PY
mkdir -p build/reports/deployment
# pipefail makes a failed deployment a failed Werkator build, even after rollback.
./tools/remote backend deploy --artifact build/release | tee build/reports/deployment/result.log