Harden hosted deploy source checks

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.31 - 2026-07-15
+
+- Started Phase 3 deploy-from-Gitea hardening by making the hosted deploy script refuse dirty or unpushed Libre Study and LibreBible data repos.
+- Added the LibreBible data commit and `origin/main` source marker to hosted deploy metadata.
+
 ## 0.1.30 - 2026-07-15
 
 - Started Phase 2 hosted accounts with a server-side user table, password hashing, login sessions, and authenticated per-user workspace persistence.

ROADMAP.md

@@ -98,12 +98,14 @@ Definition of done:
 
 Goal: make local changes flow predictably to the live app through Git.
 
+Current foundation note: the hosted deploy script now verifies that both Libre Study and LibreBible data are clean and equal to `origin/main` before it builds or publishes, and records both deployed commit hashes in deploy metadata.
+
 Tasks:
 
 - Keep Christ Unscripted Gitea as the remote source of truth for deployable code.
-- Add a deployment script that pulls or receives the pushed commit, installs/builds as needed, and publishes the web build.
+- Add a deployment script that pulls or receives the pushed commit, installs/builds as needed, and publishes the web build. Started with a manual script that only deploys clean `origin/main` state.
-- Record the deployed commit hash somewhere visible or inspectable.
+- Record the deployed commit hash somewhere visible or inspectable. Started with `deploy-info.json`, including both app and LibreBible data commits.
-- Decide whether deploys are manual first, then later automatic after push.
+- Decide whether deploys are manual first, then later automatic after push. Manual deploy remains the current private-alpha default.
 - Keep LibreBible package generation/deployment separate from Libre Study app deployment, but make the app consume the deployed package catalog.
 
 Definition of done:

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "libre-study",
-  "version": "0.1.30",
+  "version": "0.1.31",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "libre-study",
-      "version": "0.1.30",
+      "version": "0.1.31",
       "dependencies": {
         "@tauri-apps/api": "^2.11.1",
         "jszip": "^3.10.1",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "libre-study",
   "private": true,
-  "version": "0.1.30",
+  "version": "0.1.31",
   "type": "module",
   "scripts": {
     "dev": "vite --host 0.0.0.0",

scripts/deploy-web.ps1

@@ -18,11 +18,28 @@ function ConvertTo-BashSingleQuoted([string]$Value) {
   return "'" + $Value.Replace("'", "'\''") + "'"
 }
 
+function Assert-CleanPushedRepo([string]$Path, [string]$Name) {
+  git -C $Path fetch origin main
+  if ($LASTEXITCODE -ne 0) { throw "$Name fetch failed." }
+
+  $status = git -C $Path status --porcelain
+  if ($status) { throw "$Name has uncommitted changes. Commit or revert them before deploying." }
+
+  $head = (git -C $Path rev-parse HEAD).Trim()
+  $origin = (git -C $Path rev-parse origin/main).Trim()
+  if ($head -ne $origin) {
+    throw "$Name HEAD $head does not match origin/main $origin. Push the repo before deploying."
+  }
+
+  return $head
+}
+
 $repoRoot = Split-Path -Parent $PSScriptRoot
 $dataRepo = Resolve-Path (Join-Path $repoRoot "..\libre-bible-data")
+$commit = Assert-CleanPushedRepo $repoRoot "Libre Study"
+$dataCommit = Assert-CleanPushedRepo $dataRepo "LibreBible data"
 $repoRootWsl = ConvertTo-WslPath $repoRoot
 $dataRepoWsl = ConvertTo-WslPath $dataRepo
-$commit = (git -C $repoRoot rev-parse HEAD).Trim()
 $deployedAt = (Get-Date).ToUniversalTime().ToString("o")
 
 Push-Location $repoRoot
@@ -41,8 +58,10 @@ finally {
 
 $deployInfo = @{
   commit = $commit
+  libreBibleDataCommit = $dataCommit
   deployedAt = $deployedAt
   source = "libre-study"
+  sourceRemote = "origin/main"
 } | ConvertTo-Json -Compress
 $deployInfoPath = Join-Path $env:TEMP "libre-study-deploy-info.json"
 Set-Content -Path $deployInfoPath -Value $deployInfo -NoNewline