---
# Imported at the top of site.yml and dns.yml.
#
# Several agents work on this repo at once. If one deploys from an unpushed
# branch, the next deploy from main quietly puts the old config back. So a
# real run only goes ahead when this checkout is exactly origin/main:
# land your commit on main first, then deploy that commit.
#
# --check runs are always allowed. -e allow_unpushed=true skips the guard
# for emergencies; push the fix to main straight after.
- name: Only deploy what's on origin/main
  hosts: localhost
  gather_facts: false
  tags: always
  tasks:
    - name: Check this checkout matches origin/main
      ansible.builtin.shell: |
        set -eu
        git fetch -q origin main
        if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
          echo "This checkout has uncommitted changes. Commit them, land them on main, then deploy."
          exit 1
        fi
        head=$(git rev-parse HEAD); main=$(git rev-parse origin/main)
        if [ "$head" != "$main" ]; then
          echo "HEAD $(git rev-parse --short HEAD) isn't origin/main ($(git rev-parse --short origin/main))."
          if git merge-base --is-ancestor "$main" "$head"; then
            echo "Your commits aren't on main yet: rebase, push to main, then deploy."
          else
            echo "main has moved on: rebase onto origin/main first, or other agents' changes get reverted."
          fi
          exit 1
        fi
      args:
        chdir: "{{ playbook_dir }}"
      changed_when: false
      check_mode: false
      when:
        - not ansible_check_mode
        - not (allow_unpushed | default(false) | bool)