twooey
1020a496ab
- SupplierOffer::insert(): now checks $wpdb->insert()'s return value and
throws, matching Work/Edition/Isbn (the one Catalog class that hadn't
been hardened this way). Work::set_product_id() gets the same treatment
(was flagged low-severity but same fix, bundled here) — a real update
failure now counts as a per-work sync failure instead of silently
leaving a stale wc_product_id pointer.
- SupplierOffer: fetched_at was written via current_time('mysql') (site-
local) while expires_at (SyntheticOfferGenerator) is written in UTC, and
best_offer_for_isbns() compared against site-local time too — a mismatch
masked today only because dev's gmt_offset is 0. Switched both writer and
reader to current_time('mysql', true) (UTC). Verified the read path
still finds all active offers correctly under a simulated -5 (US
Eastern) offset, not just at offset 0.
- HardcoverAdapter: rate-limit throttling moved from "once per work" (in
Commands.php) to "once per actual HTTP request" (inside query() itself).
find_book()'s ISBN-then-title/author fallback can fire two real requests
per work — under the old scheme both shared one throttle sleep, roughly
doubling the real request rate against a beta API. query() also now
retries network errors/5xx/429 up to 3x (mirroring
OpenLibraryAdapter::get_with_retry()), while a GraphQL-level `errors` field
or other 4xx throws immediately (retrying a rejected query can't fix it).
Commands.php adds a 5-consecutive-failure circuit breaker so a bad token
or a wrong field in the still-unverified schema can't silently burn
through the whole catalog with zero progress. Verified all of this
directly against Hardcover's real API with a deliberately invalid token:
5 fast (non-retried) 401s, correct abort message, and confirmed the
failed works were NOT marked synced (so a real token can retry them).
- restore.sh: now drops and recreates the target database before restoring
the dump, and clears the uploads directory before extracting the
archive — previously both restored on top of existing state, so a stray
table or file NOT in the backup would silently survive a restore drill.
Verified end-to-end against a real local staging stack: planted a stray
table and a stray upload file after taking a backup, ran restore.sh, and
confirmed both were gone afterward while the actual backed-up data (20
works, a known upload file) came back correctly. Also fixed a real
permission gap hit during that same test: a fresh volume's uploads dir
is root-owned until something chowns it, which broke the new www-data
clear step — now clears as root and chowns to www-data afterward, which
also means restore self-heals the exact root-owned-uploads class of bug
fixed earlier this session for the cron sidecar.
- poll-deploy.sh: added a non-blocking flock so a deploy that runs longer
than the cron interval can't have a second poll fire mid-deploy and race
its git checkout/reset against the same live working tree. Verified: a
concurrent run correctly skips instantly while the lock is held, and
proceeds normally once it's released. (Full atomicity of the live PHP
file swap under real traffic is a bigger architectural question —
blue-green or symlinked releases — flagged to the user rather than
attempted here.)
- backup.sh: now also archives .env.<environment> itself (chmod 600) and
includes it in the off-host rclone sync alongside the DB dump and
uploads archive. Every API key and both DB passwords previously lived
only on the host in this one gitignored file — losing the host lost all
of it even with DB/uploads backups intact.
48 lines
1.8 KiB
Bash
Executable File
48 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Meant to run via the HOST's system crontab on each environment's box (not
|
|
# inside a container) — Gitea lives on a separate machine, so rather than
|
|
# exposing an inbound webhook receiver on staging/production, each box just
|
|
# polls its branch and redeploys when it moves. Silent when there's nothing
|
|
# new, so it's safe to run every couple of minutes from cron.
|
|
#
|
|
# Example crontab line (staging box):
|
|
# */2 * * * * /srv/bookstore/deploy/poll-deploy.sh staging >> /var/log/bookstore-deploy.log 2>&1
|
|
set -euo pipefail
|
|
|
|
ENVIRONMENT="${1:?Usage: poll-deploy.sh <staging|production>}"
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
# A deploy (docker compose up --build + full WP/plugin install) can run
|
|
# longer than the cron interval on modest hardware, and the git
|
|
# checkout/reset below writes directly onto the live working tree that's
|
|
# bind-mounted into the running containers — a second poll firing mid-deploy
|
|
# would race the first one's file writes. Non-blocking: if one's already
|
|
# running, this run just skips (the next poll picks up wherever HEAD ends up),
|
|
# rather than queuing up concurrent deploys.
|
|
LOCK_FILE="${REPO_ROOT}/.poll-deploy-${ENVIRONMENT}.lock"
|
|
exec 200>"$LOCK_FILE"
|
|
if ! flock -n 200; then
|
|
echo "$(date -Is) deploy already in progress for ${ENVIRONMENT}, skipping this poll"
|
|
exit 0
|
|
fi
|
|
|
|
case "$ENVIRONMENT" in
|
|
staging) BRANCH=staging ;;
|
|
production) BRANCH=main ;;
|
|
*) echo "environment must be 'staging' or 'production'" >&2; exit 1 ;;
|
|
esac
|
|
|
|
BEFORE="$(git rev-parse HEAD)"
|
|
git fetch origin "$BRANCH" --quiet
|
|
AFTER="$(git rev-parse "origin/${BRANCH}")"
|
|
|
|
if [[ "$BEFORE" == "$AFTER" ]]; then
|
|
exit 0
|
|
fi
|
|
|
|
echo "$(date -Is) deploying ${ENVIRONMENT} (${BRANCH}): ${BEFORE:0:7} -> ${AFTER:0:7}"
|
|
git checkout -f "$BRANCH"
|
|
git reset --hard "origin/${BRANCH}"
|
|
"$REPO_ROOT/deploy/deploy.sh" "$ENVIRONMENT"
|