Files
shopdb-flask/tools/git-push.cmd
cproudlock 49a898fc5a
All checks were successful
CI / naming (push) Successful in 3s
CI / frontend (push) Successful in 18s
CI / migrations-mysql (push) Successful in 42s
CI / backend (push) Successful in 4m15s
Add Windows versions of the push and promote scripts
Same two operations as the bash pair, for driving git from Windows rather than
from the development box.

CREDENTIALS ARE HANDLED DIFFERENTLY, ON PURPOSE

The bash version reads a token out of secrets.md and feeds it to git through
GIT_ASKPASS, because that box has no credential store. Windows has one: Git for
Windows installs Git Credential Manager and enables it by default, so `git push`
prompts once and Windows Credential Manager keeps it.

So the token handling is deliberately NOT ported. Copying a token into a script,
an environment variable or a remote URL on a machine that already has a
credential store is strictly worse than the thing it would replace, and the
comment in the file says so, because "make it match the other script" is exactly
the tidying somebody would otherwise do later.

THE PROMOTE SCRIPT REFUSES TO RUN WITHOUT BASH

scripts/check-naming-and-style.sh is a shell script, and it carries the ADR-015
site-literal check - the one gate that makes a site branch survivable rather
than a slow leak into the product. Skipping it on a machine without bash would
defeat the entire point of the script, so it stops and says how to fix it
instead of promoting without it.

CRLF

.gitattributes already pinned *.sh to LF so Git Bash can run them; *.cmd is now
pinned to CRLF for the same class of reason in the other direction. cmd.exe
parses a lone LF inconsistently around labels and goto, so an LF-only batch file
can run its happy path and then jump nowhere on the error path - which in a
promote script is the path that matters.
2026-08-30 08:48:27 -04:00

64 lines
1.9 KiB
Batchfile

@echo off
setlocal
rem Push a branch to the internal git server, from Windows.
rem
rem tools\git-push.cmd push the current branch
rem tools\git-push.cmd wj push a named branch
rem
rem CREDENTIALS ARE NOT THIS SCRIPT'S JOB HERE.
rem
rem The bash version of this script reads a token out of secrets.md and feeds it
rem to git through GIT_ASKPASS, because that box has no credential store. Windows
rem does: Git for Windows installs Git Credential Manager and enables it by
rem default, so `git push` prompts once and Windows Credential Manager keeps it
rem after that.
rem
rem So do NOT port the token handling here. Copying a token into a script, an
rem environment variable or a remote URL on a machine that already has a
rem credential store is strictly worse than the thing it replaces.
rem
rem If a push here asks for a password every time, the fix is to check the
rem credential helper, not to embed a token:
rem git config --global credential.helper manager
cd /d "%~dp0.."
set "BRANCH=%~1"
if "%BRANCH%"=="" (
for /f "delims=" %%b in ('git rev-parse --abbrev-ref HEAD') do set "BRANCH=%%b"
)
if "%BRANCH%"=="HEAD" (
echo ERROR: detached HEAD. Check out a branch, or name one.
exit /b 1
)
git show-ref --verify --quiet "refs/heads/%BRANCH%"
if errorlevel 1 (
echo ERROR: no such local branch: %BRANCH%
exit /b 1
)
rem A push of a dirty tree pushes the LAST commit, not what is in front of you.
rem That reads as a successful push and is found out much later.
for /f "delims=" %%s in ('git status --porcelain') do (
echo Working tree is not clean:
git status --short
echo.
echo Commit or stash first - a push of a dirty tree pushes the LAST commit,
echo not what you are looking at.
exit /b 1
)
echo Pushing %BRANCH% ...
git push origin "%BRANCH%"
if errorlevel 1 (
echo.
echo Push failed.
exit /b 1
)
echo Pushed %BRANCH%.
endlocal