deploy-erosi.sh now runs `git describe --exact-match --tags HEAD` up
front. When HEAD is not at a tag, prints a yellow warning and sleeps
5s so the operator can Ctrl-C and tag before the rsync starts (no
abort — keeps untagged hotfix deploys possible). When a tag is
present, surfaces it in the banner next to the SHA.
`.deploys.log` gains a 4th tab-separated column: the tag (empty when
absent). The 3-column compat for pre-Fase-17 rows is preserved — the
rollback script's existing `cut -f1/-f2/-f3` keeps working, and `cut
-f4` returns the empty string for the older rows.
rollback-erosi.sh:
- `--list` reformats each row through awk so the tag is visible (with
"(no tag)" placeholder for older rows), falling back to the raw log
when awk isn't on PATH.
- The target banner shows `git tag: <tag>` when present.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Post-deploy, PostgREST keeps its pre-migration pg_proc snapshot and
404s any RPC added in the just-applied migrations until the rest
container restarts. Confirmed on 2026-05-18 after migration 026
(set_item_frequency_weight + purge_item_frequency) — the "Purgar"
button in /collective/manage returned "Could not find the function
public.purge_item_frequency in the schema cache".
`NOTIFY pgrst, 'reload schema'` triggers the same reload path the
container would do on restart, but without a 2s blip in flight requests.
Added at the end of the migration loop in deploy-erosi.sh, and at the
end of the rebuild step in rollback-erosi.sh (rollback can change RPC
shapes too).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Every `just deploy` now takes a pg_dumpall to
/opt/colectivo/backups/predeploy-<ts>-<sha>.sql.gz BEFORE rebuilding the
app or applying migrations, aborts the deploy if the dump is < 1 KiB,
and (on success) appends `<iso-ts> \t <sha> \t <backup-file>` to
/opt/colectivo/.deploys.log on ambrosio. Keeps the newest 10 backups
(prunes older predeploy-* files).
New `infra/scripts/rollback-erosi.sh` reads .deploys.log and pairs a
code rollback with a DB restore atomically:
just rollback-list # show recent deploys
just rollback # roll back to N-1
just rollback-to <sha> # roll back to a specific deploy
just rollback-code # roll back code only, keep current DB
Rollback safety:
- 5-second abort window.
- Verifies the target SHA exists locally + the backup is still on prod
(warns if it's been pruned past the 10-deploy window).
- Uses a temporary git worktree so the user's working tree isn't
disturbed.
- Stops app/auth/rest/realtime/storage before the gunzip|psql restore.
- Rebuilds the app image at the rolled-back SHA with the same GIT_SHA
build-arg path the deploy uses (so __APP_COMMIT__ in the bundle
matches the running code).
- Does NOT write a new .deploys.log entry — rollback is intentionally
not a deploy event; the next `just deploy` is from current HEAD.
- Storage volume (/var/lib/storage user uploads) is NOT rolled back.
Justfile `deploy` recipe repointed from the stale `deploy.sh` (which
referenced GHCR pull) to `deploy-erosi.sh` (the active prod path).
New project-scoped skill: `.claude/skills/deploy/SKILL.md` documents the
flow + safety boundaries for Claude-assisted invocations. `.gitignore`
keeps `.claude/settings.local.json` ignored but tracks `.claude/skills/`.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
