WFDASH-WEBAPP/scripts/pb-hooks/sync-pb-hooks.sh

#!/bin/sh
# Sync the WFDASH PocketBase hooks from git into the live hooks volume.
#
# Runs on the VPS from cron. Pulls origin/main of the WFDASH-PBHOOKS repo
# (a copy of this app's pocketbase/pb_hooks folder, published with
# `npm run pb:hooks:publish`) and copies every file listed in its DEPLOY
# file into the PocketBase hooks
# volume. PocketBase reloads itself when a file in pb_hooks changes, so no
# container restart is needed. Files are only written when their content
# changed, so an unchanged repo never triggers a reload.
#
# Usage: sync-pb-hooks.sh [--force]   (--force re-syncs even if HEAD is current)
set -eu

REPO="${PB_HOOKS_REPO:-/opt/wfdash-pb-hooks/repo}"
TARGET="${PB_HOOKS_TARGET:-/var/lib/docker/volumes/gnqc88suy8fqk6wyryjjdpvl_pocketbase-hooks/_data}"
LOCK="${PB_HOOKS_LOCK:-/tmp/wfdash-pb-hooks-sync.lock}"

log() { echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $*"; }

exec 9>"$LOCK"
if ! flock -n 9; then
  log "another sync is running; skipping"
  exit 0
fi

cd "$REPO"
git fetch --quiet origin main
if [ "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" ] && [ "${1:-}" != "--force" ]; then
  exit 0
fi
git reset --quiet --hard origin/main

SRC="${PB_HOOKS_SRC:-$REPO}"
LIST="$SRC/DEPLOY"
if [ ! -f "$LIST" ]; then
  log "no $LIST; nothing deployed"
  exit 1
fi

# Validate the whole list before touching the live folder.
WANTED=$(grep -v '^[[:space:]]*#' "$LIST" | sed 's/[[:space:]]*$//' | grep -v '^$' || true)
for f in $WANTED; do
  case "$f" in
    */*|.*) log "refusing unsafe name in DEPLOY: $f"; exit 1 ;;
  esac
  if [ ! -f "$SRC/$f" ]; then
    log "listed file missing in repo: $f — nothing changed"
    exit 1
  fi
done

changed=0
for f in $WANTED; do
  if ! cmp -s "$SRC/$f" "$TARGET/$f"; then
    cp "$SRC/$f" "$TARGET/$f.tmp"
    mv "$TARGET/$f.tmp" "$TARGET/$f"
    log "updated $f"
    changed=1
  fi
done

# Remove deployed .js files that are no longer listed.
for path in "$TARGET"/*.js; do
  [ -e "$path" ] || continue
  name=$(basename "$path")
  if ! printf '%s\n' $WANTED | grep -qx "$name"; then
    rm -f "$path"
    log "removed $name (not in DEPLOY)"
    changed=1
  fi
done

log "synced $(git rev-parse --short HEAD) (changed=$changed)"