ia_dev/deploy/deploy-by-script-to.sh

#!/usr/bin/env bash
# deploy-by-script-to [project_id] <target_branch>: checkout target, verify .secrets/<env>, force sync with origin, deploy target, checkout test.
# Launched from ia_dev root. Project from projects/<id>/conf.json; id from param, or MAIL_TO or AI_AGENT_TOKEN. Target: pprod | prod only.
set -euo pipefail

SCRIPT_REAL="$(readlink -f "${BASH_SOURCE[0]:-$0}" 2>/dev/null || realpath "${BASH_SOURCE[0]:-$0}" 2>/dev/null || echo "${BASH_SOURCE[0]:-$0}")"
DEPLOY_IA="$(cd "$(dirname "$SCRIPT_REAL")" && pwd)"
IA_DEV_ROOT="$(cd "$DEPLOY_IA/.." && pwd)"

# Optional first arg: project id (must exist as projects/<id>/conf.json)
if [[ -n "${1:-}" && ! "$1" =~ ^(pprod|prod)$ && -f "${IA_DEV_ROOT}/projects/${1}/conf.json" ]]; then
	export IA_PROJECT_ID="$1"
	shift
fi
# shellcheck source=../lib/project_config.sh
source "${IA_DEV_ROOT}/lib/project_config.sh"
# shellcheck source=../lib/project_git_root_from_conf.sh
source "${IA_DEV_ROOT}/lib/project_git_root_from_conf.sh"
ia_dev_resolve_project_git_root
PROJECT_ROOT="${IA_PROJECT_GIT_ROOT:-}"
if [[ -z "$PROJECT_ROOT" || ! -d "$PROJECT_ROOT" ]]; then
	PROJECT_ROOT="$(cd "$DEPLOY_IA/../.." && pwd)"
fi
if [[ -n "${PROJECT_CONFIG_PATH:-}" && -f "${PROJECT_CONFIG_PATH:-}" ]] && command -v jq >/dev/null 2>&1; then
	_sp="$(jq -r '.deploy.secrets_path // empty' "$PROJECT_CONFIG_PATH" 2>/dev/null)"
	if [[ -n "$_sp" && "$_sp" != "null" && -d "$_sp" ]]; then
		export SECRETS_BASE="$_sp"
		export LECOFFRE_SECRETS_BASE="$_sp"
	fi
fi
if [[ "$(pwd)" != "$PROJECT_ROOT" ]]; then
	# Preserve project id for re-exec so config is still resolved in child
	[[ -n "${PROJECT_ID:-}" ]] && export IA_PROJECT_ID="$PROJECT_ID"
	cd "$PROJECT_ROOT" && exec "$SCRIPT_REAL" "$@"
fi
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
	echo "[deploy-by-script-to][ERROR] Not in a git repository (PROJECT_ROOT=${PROJECT_ROOT})" >&2
	exit 1
fi

TARGET_BRANCH="${1:-}"
if [[ -z "$TARGET_BRANCH" ]]; then
	echo "[deploy-by-script-to][ERROR] Missing <target_branch> argument (expected: pprod | prod)" >&2
	echo "Usage: ./deploy/deploy-by-script-to.sh [project_id] <target_branch>  (from ia_dev; pprod or prod only)" >&2
	exit 1
fi
if [[ ! "$TARGET_BRANCH" =~ ^(pprod|prod)$ ]]; then
	echo "[deploy-by-script-to][ERROR] Invalid target branch: must be pprod or prod (got: '${TARGET_BRANCH}')" >&2
	echo "Usage: ./deploy/deploy-by-script-to.sh [project_id] <pprod|prod>" >&2
	exit 1
fi

current="$(git rev-parse --abbrev-ref HEAD)"
if [[ "$current" != "test" ]]; then
	echo "[deploy-by-script-to][ERROR] Must be on branch 'test' (current: '${current}'). Run /change-to-all-branches first." >&2
	exit 1
fi

echo "[deploy-by-script-to] Step 1/5: checkout ${TARGET_BRANCH}..."
if [[ "$(git rev-parse --abbrev-ref HEAD)" != "$TARGET_BRANCH" ]]; then
	git checkout "$TARGET_BRANCH"
fi

SECRETS_PARENT="${SECRETS_BASE:-${LECOFFRE_SECRETS_BASE:-$PROJECT_ROOT/.secrets}}"
SECRETS_DIR="${SECRETS_PARENT}/${TARGET_BRANCH}"
if [[ ! -d "$SECRETS_DIR" ]]; then
	echo "[deploy-by-script-to][ERROR] secrets env dir missing: ${SECRETS_DIR} (set SECRETS_BASE or deploy.secrets_path in conf)" >&2
	exit 1
fi
echo "[deploy-by-script-to] Step 2/5: secrets/${TARGET_BRANCH} OK (${SECRETS_DIR})"

echo "[deploy-by-script-to] Step 3/5: force sync local branch with origin/${TARGET_BRANCH}..."
git fetch origin
git reset --hard "origin/${TARGET_BRANCH}"

echo "[deploy-by-script-to] Step 4/5: deploy ${TARGET_BRANCH} (business flags from deploy.conf only)..."
if [[ -n "${IA_PROJECT_ID:-}" && -x "${DEPLOY_IA}/orchestrator.sh" ]]; then
	"${DEPLOY_IA}/orchestrator.sh" "$TARGET_BRANCH"
else
	deploy_script="$PROJECT_ROOT/deploy/scripts_v2/deploy.sh"
	if [[ -n "${PROJECT_CONFIG_PATH:-}" && -f "${PROJECT_CONFIG_PATH:-}" ]] && command -v jq >/dev/null 2>&1; then
		_cfg_script="$(jq -r '.deploy.deploy_script_path // ""' "$PROJECT_CONFIG_PATH" 2>/dev/null)"
		[[ -n "$_cfg_script" && -x "$_cfg_script" ]] && deploy_script="$_cfg_script"
	fi
	"$deploy_script" "$TARGET_BRANCH"
fi

echo "[deploy-by-script-to] Step 5/5: checkout test..."
git checkout test

echo "[deploy-by-script-to] OK: aligned, synced, deployed to ${TARGET_BRANCH}, back on test"