From 2e90ab885bc556199c0bfd3819c0afdadea9e1d8 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sat, 1 Aug 2026 12:27:59 -0700 Subject: [PATCH] Reconcile the two documented forms of the release command The verification loop said `make-release.sh` "takes no arguments" while the Deploying section below it passes a deploy root and a version. Read together those contradict, and the first is only true because the local loop sources `secrets/.env` a few lines earlier. Both forms are correct and the document never said why. It now states the mechanism: the deploy root falls back to `$DEPLOY_ROOT` and the version to a timestamp, the script accepts both regardless, and an argument wins over the environment. It also says why CI passes them explicitly, which is so a pipeline run names the commit it built rather than the clock. Verified against the script rather than asserted: ROOT="${1:-${DEPLOY_ROOT:-}}" VERSION="${2:-$(date -u +%Y%m%d-%H%M%S)}" Raised as a suppressed comment on the promotion, which carries no thread. Co-Authored-By: Claude Opus 5 (1M context) --- OPERATIONS.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/OPERATIONS.md b/OPERATIONS.md index 4317a6d..1fc7094 100644 --- a/OPERATIONS.md +++ b/OPERATIONS.md @@ -55,7 +55,9 @@ So the failure is specific. **When the release changed `deploy/Caddyfile` or any The step is unconditional anyway, for two reasons. Deciding correctly means knowing whether anything reached the config, which is easy to get wrong when a change spans several paths or a map was regenerated as a side effect. And getting it wrong is silent, since the wrong answer is a green check rather than an error. A restart costs a few seconds on a static site, which is cheaper than reasoning about it each time. -Sourcing `secrets/.env` first puts the deploy root and the base URL in the environment, so no literal value is typed. `make-release.sh` then takes no arguments, and it refuses to install a release that fails the build gate. `check-live-urls.sh` does take a base URL, which is where the sourced `$HUGO_BASEURL` goes. It follows all 1,245 URLs against the running mirror, checking each redirect's destination rather than trusting its status code. +Sourcing `secrets/.env` first puts the deploy root and the base URL in the environment, so no literal value is typed. `make-release.sh` then needs no arguments, because its deploy root falls back to `$DEPLOY_ROOT` and its version falls back to a timestamp. It still accepts both, and [Deploying](#deploying) below passes them explicitly, which is what CI does so a pipeline run names the commit it built rather than the clock. Either form works locally, and the argument wins over the environment. + +It refuses to install a release that fails the build gate. `check-live-urls.sh` does take a base URL, which is where the sourced `$HUGO_BASEURL` goes. It follows all 1,245 URLs against the running mirror, checking each redirect's destination rather than trusting its status code. Expect `PASS - 1245 URLs honored`. Anything less is a finding, and the output names each URL that failed and what it answered.