81 lines
4.3 KiB
PowerShell
81 lines
4.3 KiB
PowerShell
# Official production deploy of the GTI Fiscal Hub (10.0.10.117). Run by the OPERATOR, outside Claude Code:
|
|
# powershell -ExecutionPolicy Bypass -File .\scripts\deploy_hub.ps1 [-PublishAgent] [-Version 1.1.5] [-SkipTests] [-DryRun]
|
|
# SSH password: env GTI_SSH_PASSWORD, else GTI_SSH_PASSWORD=... in .env.local (gitignored). Never printed or logged.
|
|
[CmdletBinding()]
|
|
param(
|
|
[string]$Version = "",
|
|
[switch]$PublishAgent,
|
|
[switch]$SkipTests,
|
|
[switch]$DryRun,
|
|
[string]$Python = "python"
|
|
)
|
|
$ErrorActionPreference = "Stop"
|
|
$Root = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
|
|
Set-Location $Root
|
|
$LogDir = Join-Path $Root "logs"; New-Item -ItemType Directory -Force $LogDir | Out-Null
|
|
$Log = Join-Path $LogDir ("deploy-{0}.log" -f (Get-Date -Format "yyyyMMdd-HHmmss"))
|
|
Start-Transcript -Path $Log | Out-Null
|
|
try {
|
|
if (-not $Version) { $Version = (Get-Content (Join-Path $Root "release\VERSION") -Raw).Trim() }
|
|
|
|
# 3. credential: process env wins, then .env.local
|
|
$src = "env"
|
|
if (-not $env:GTI_SSH_PASSWORD) {
|
|
$envFile = Join-Path $Root ".env.local"
|
|
if (Test-Path $envFile) {
|
|
$line = Get-Content $envFile | Where-Object { $_ -match '^\s*GTI_SSH_PASSWORD\s*=' } | Select-Object -First 1
|
|
if ($line) { $env:GTI_SSH_PASSWORD = ($line -replace '^\s*GTI_SSH_PASSWORD\s*=\s*', '').Trim().Trim('"').Trim("'"); $src = ".env.local" }
|
|
}
|
|
}
|
|
if (-not $env:GTI_SSH_PASSWORD) { throw "GTI_SSH_PASSWORD not found in the environment or .env.local" }
|
|
Write-Host "SSH_AUTH_SOURCE=$src PASSWORD_LOGGED=false"
|
|
|
|
# 2. local pre-checks
|
|
git check-ignore -q .env.local
|
|
if ($LASTEXITCODE -ne 0 -and (Test-Path ".env.local")) { throw ".env.local is not gitignored" }
|
|
$dirty = git status --porcelain
|
|
if ($dirty) { throw "working tree is not clean - commit or stash first:`n$dirty" }
|
|
$branch = git rev-parse --abbrev-ref HEAD; $head = git rev-parse --short HEAD
|
|
Write-Host "BRANCH=$branch HEAD=$head VERSION=$Version"
|
|
$fileVersion = (Get-Content (Join-Path $Root "release\VERSION") -Raw).Trim()
|
|
if ($fileVersion -ne $Version) { throw "release/VERSION is $fileVersion but -Version is $Version" }
|
|
if ($PublishAgent) {
|
|
$exe = Join-Path $Root "dist\installer\GTIFiscalAgent-Setup-$Version.exe"
|
|
if (-not (Test-Path $exe)) { throw "installer not built: $exe (run scripts\build_windows_installer.ps1)" }
|
|
}
|
|
if (-not $SkipTests) {
|
|
# per-run basetemp: some tests ACL-lock their tmp dirs, which breaks pytest's shared default temp root
|
|
$base = Join-Path $Root (".pytmp
|
|
un-" + (Get-Date -Format "yyyyMMddHHmmss"))
|
|
& $Python -m pytest tests central/tests agent/tests -q -p no:cacheprovider --basetemp=$base
|
|
if ($LASTEXITCODE -ne 0) { throw "tests failed - deploy aborted" }
|
|
}
|
|
|
|
# 4. route/SSH recovery: reconnect the existing Windows VPN profile "GTI" (saved credentials) and retry
|
|
$reachable = $false
|
|
for ($i = 1; $i -le 3 -and -not $reachable; $i++) {
|
|
$reachable = (Test-NetConnection 10.0.10.117 -Port 22 -WarningAction SilentlyContinue).TcpTestSucceeded
|
|
if (-not $reachable) {
|
|
Write-Host "SSH_UNREACHABLE attempt=$i - reconnecting VPN profile GTI"
|
|
rasdial GTI | Out-Null
|
|
Start-Sleep -Seconds (10 * $i)
|
|
}
|
|
}
|
|
if (-not $reachable) { throw "FAILED_STAGE=network REMOTE_ERROR=10.0.10.117:22 unreachable after 3 attempts (VPN profile GTI)" }
|
|
Write-Host "SSH_ROUTE_OK"
|
|
Remove-Item (Join-Path $LogDir "last_deploy_result.json") -ErrorAction SilentlyContinue
|
|
|
|
$deployArgs = @("scripts\deploy_hub_remote.py", "--version", $Version)
|
|
if ($DryRun) { $deployArgs += "--dry-run" }
|
|
if ($PublishAgent) { $deployArgs += "--publish-agent" }
|
|
& $Python @deployArgs
|
|
if ($LASTEXITCODE -ne 0) {
|
|
$res = Join-Path $LogDir "last_deploy_result.json"
|
|
$detail = if (Test-Path $res) { $j = Get-Content $res -Raw | ConvertFrom-Json; "FAILED_STAGE/ERROR=$($j.error) ROLLBACK_REQUIRED=$($j.rollback_required)" } else { "no result file (see $Log)" }
|
|
throw "remote deploy failed: $detail"
|
|
}
|
|
Write-Host "DEPLOY_SCRIPT_OK log=$Log"
|
|
} finally {
|
|
Remove-Item Env:GTI_SSH_PASSWORD -ErrorAction SilentlyContinue
|
|
Stop-Transcript | Out-Null
|
|
}
|