chore: add safe republish workflow

republish.sh

@@ -0,0 +1,69 @@
+#!/bin/sh
+set -eu
+
+script_dir="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+cd "${script_dir}"
+
+usage() {
+  echo "Usage: $0 [--build]" >&2
+}
+
+build_image=false
+case "${1:-}" in
+  "")
+    ;;
+  --build)
+    build_image=true
+    ;;
+  *)
+    usage
+    exit 2
+    ;;
+esac
+
+if [ "$#" -gt 1 ]; then
+  usage
+  exit 2
+fi
+
+if [ -f "docker-compose.yml" ]; then
+  compose_file="docker-compose.yml"
+elif [ -f "compose.yaml" ]; then
+  compose_file="compose.yaml"
+else
+  echo "No supported Compose file found." >&2
+  exit 1
+fi
+
+compose_backup="${compose_file}.bak"
+
+if [ ! -f "${compose_backup}" ]; then
+  echo "Missing deployment Compose backup: ${compose_backup}" >&2
+  exit 1
+fi
+
+if ! cmp -s "${compose_backup}" "${compose_file}"; then
+  echo "${compose_file} differs from ${compose_backup}; refusing to republish." >&2
+  diff -u "${compose_backup}" "${compose_file}" >&2 || true
+  exit 1
+fi
+
+# Restore the deployment-specific Compose file even if a Git operation fails.
+restore_compose() {
+  cp "${compose_backup}" "${compose_file}"
+}
+trap restore_compose EXIT
+
+git restore -- "${compose_file}"
+git fetch --all --prune
+git pull --ff-only
+
+restore_compose
+trap - EXIT
+
+docker compose down -v
+if [ "${build_image}" = true ]; then
+  docker compose up -d --build
+else
+  docker compose up -d
+fi