PhilandClaude Opus 5.5
0875389d02
Deploys from unpushed branches were being reverted by the next deploy from main, and in-place vault edits could overwrite each other. - deploy-guard.yml (imported by site.yml and dns.yml) refuses real runs unless the checkout is clean and exactly origin/main; --check is fine. - bin/deploy holds a lock so only one deploy runs at a time. - bin/vault-run edits the vault under a lock with an atomic swap. - bin/worktree starts a task in a fresh worktree from origin/main. - CLAUDE.md explains the workflow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
15 lines
571 B
Bash
Executable File
15 lines
571 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Run a playbook while holding the deploy lock, so only one agent deploys at a
|
|
# time. Arguments go straight to ansible-playbook.
|
|
# bin/deploy --tags gitea (site.yml)
|
|
# bin/deploy --check --diff
|
|
# PLAYBOOK=dns.yml bin/deploy
|
|
# Real runs only work from a clean checkout of origin/main (deploy-guard.yml).
|
|
set -euo pipefail
|
|
. "$(dirname "$0")/_common.sh"
|
|
link_vault
|
|
take_lock deploy
|
|
cd "$repo"
|
|
"$main_checkout/.venv/bin/ansible-playbook" "${PLAYBOOK:-site.yml}" -i hosts.yml \
|
|
--vault-password-file "$main_checkout/vault_pass" "$@"
|