feat: official operator-run Hub deploy script (backup, migrate, health, release, rollback)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-24 10:02:28 -03:00
parent 71bbf3e0bd
commit 7dc437c01c
4 changed files with 276 additions and 0 deletions
@@ -0,0 +1,60 @@
+# Official production deploy of the GTI Fiscal Hub (10.0.10.117). Run by the OPERATOR, outside Claude Code:
+#   powershell -ExecutionPolicy Bypass -File .\scripts\deploy_hub.ps1 [-PublishAgent] [-Version 1.1.5] [-SkipTests] [-DryRun]
+# SSH password: env GTI_SSH_PASSWORD, else GTI_SSH_PASSWORD=... in .env.local (gitignored). Never printed or logged.
+[CmdletBinding()]
+param(
+    [string]$Version = "",
+    [switch]$PublishAgent,
+    [switch]$SkipTests,
+    [switch]$DryRun,
+    [string]$Python = "python"
+)
+$ErrorActionPreference = "Stop"
+$Root = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
+Set-Location $Root
+$LogDir = Join-Path $Root "logs"; New-Item -ItemType Directory -Force $LogDir | Out-Null
+$Log = Join-Path $LogDir ("deploy-{0}.log" -f (Get-Date -Format "yyyyMMdd-HHmmss"))
+Start-Transcript -Path $Log | Out-Null
+try {
+    if (-not $Version) { $Version = (Get-Content (Join-Path $Root "release\VERSION") -Raw).Trim() }
+
+    # 3. credential: process env wins, then .env.local
+    $src = "env"
+    if (-not $env:GTI_SSH_PASSWORD) {
+        $envFile = Join-Path $Root ".env.local"
+        if (Test-Path $envFile) {
+            $line = Get-Content $envFile | Where-Object { $_ -match '^\s*GTI_SSH_PASSWORD\s*=' } | Select-Object -First 1
+            if ($line) { $env:GTI_SSH_PASSWORD = ($line -replace '^\s*GTI_SSH_PASSWORD\s*=\s*', '').Trim().Trim('"').Trim("'"); $src = ".env.local" }
+        }
+    }
+    if (-not $env:GTI_SSH_PASSWORD) { throw "GTI_SSH_PASSWORD not found in the environment or .env.local" }
+    Write-Host "SSH_AUTH_SOURCE=$src PASSWORD_LOGGED=false"
+
+    # 2. local pre-checks
+    git check-ignore -q .env.local
+    if ($LASTEXITCODE -ne 0 -and (Test-Path ".env.local")) { throw ".env.local is not gitignored" }
+    $dirty = git status --porcelain
+    if ($dirty) { throw "working tree is not clean - commit or stash first:`n$dirty" }
+    $branch = git rev-parse --abbrev-ref HEAD; $head = git rev-parse --short HEAD
+    Write-Host "BRANCH=$branch HEAD=$head VERSION=$Version"
+    $fileVersion = (Get-Content (Join-Path $Root "release\VERSION") -Raw).Trim()
+    if ($fileVersion -ne $Version) { throw "release/VERSION is $fileVersion but -Version is $Version" }
+    if ($PublishAgent) {
+        $exe = Join-Path $Root "dist\installer\GTIFiscalAgent-Setup-$Version.exe"
+        if (-not (Test-Path $exe)) { throw "installer not built: $exe (run scripts\build_windows_installer.ps1)" }
+    }
+    if (-not $SkipTests) {
+        & $Python -m pytest tests central/tests agent/tests -q -p no:cacheprovider
+        if ($LASTEXITCODE -ne 0) { throw "tests failed - deploy aborted" }
+    }
+
+    $deployArgs = @("scripts\deploy_hub_remote.py", "--version", $Version)
+    if ($DryRun) { $deployArgs += "--dry-run" }
+    if ($PublishAgent) { $deployArgs += "--publish-agent" }
+    & $Python @args
+    if ($LASTEXITCODE -ne 0) { throw "remote deploy failed (see ROLLBACK_REQUIRED above)" }
+    Write-Host "DEPLOY_SCRIPT_OK log=$Log"
+} finally {
+    Remove-Item Env:GTI_SSH_PASSWORD -ErrorAction SilentlyContinue
+    Stop-Transcript | Out-Null
+}