From 58b53b50f69a0bfa596a9a4f16f43fa3035a280b Mon Sep 17 00:00:00 2001 From: cproudlock Date: Sun, 30 Aug 2026 12:53:14 -0400 Subject: [PATCH] Refuse --dist anywhere but main The bundle became one file per branch, but the frontend dists did not: they are still frontend-dist-subpath-{ops,shopdb}, fixed paths, and update-prod-server.cmd robocopies the shopdb one onto the production server with /MIR - a full mirror - with no idea which branch built it. So --dist from a site branch would have replaced production's frontend with unreleased work at the next deploy, silently, and nothing downstream could have told. Worse than the bundle collision it was sitting beside, because the dist is what actually lands on the server. Branch-qualifying the directories would only move the trap to whoever pointed a deploy at the wrong one. Production runs the product, so the export now refuses and says which commits to promote instead. Scope: product --- tools/export-github.sh | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/tools/export-github.sh b/tools/export-github.sh index 7c4ca2a5..baf9c824 100755 --- a/tools/export-github.sh +++ b/tools/export-github.sh @@ -261,6 +261,31 @@ echo "bundle: $BUNDLE" # --- 6. optional per-instance dists (both bases: /ops = dev, /shopdb = prod) --- # Two instances run on the box; each needs its own base-path build. Always # rebuild BOTH so prod never ships a stale frontend. +# --dist IS MAIN ONLY. +# +# These paths are not branch-qualified and cannot safely be: update-prod-server +# .cmd robocopies frontend-dist-subpath-shopdb onto the production server with +# /MIR, a full mirror, and has no idea which branch built it. So --dist from a +# site branch would replace production's frontend with unreleased work at the +# next deploy, silently, and the deploy script could not tell. +# +# Branch-qualifying the directory would leave the same trap for whoever pointed +# a deploy at the wrong one. Production runs the product; a site branch has no +# business producing the artefact production installs. +if [ "$BUILD_DIST" = 1 ] && [ "$BRANCH" != "main" ]; then + echo "REFUSED: --dist on branch '$BRANCH'." >&2 + echo >&2 + echo "The dist directories are what update-prod-server.cmd mirrors onto the" >&2 + echo "production server, and they are not branch-qualified. Building them" >&2 + echo "from '$BRANCH' would put unreleased work on production at the next" >&2 + echo "deploy, with nothing to reveal it." >&2 + echo >&2 + echo "Promote the commits to main and export from there:" >&2 + echo " tools/wj-status.sh" >&2 + echo " tools/promote-to-main.sh ..." >&2 + exit 1 +fi + if [ "$BUILD_DIST" = 1 ]; then cd "$WORK/frontend" for base in ops shopdb; do