From f8444ec9beefb3407ac7de49782eaa73b2ec4e6d Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 11 Oct 2026 06:44:16 +0000
Subject: [PATCH] Deploy the Linux verae-print checkout after tests pass.

---
 .forgejo/workflows/test-and-deploy.yml |  24 +++++
 scripts/deploy-138.sh                  | 117 +++++++++++++++++++++++++
 scripts/test-138.sh                    |   5 ++
 3 files changed, 146 insertions(+)
 create mode 100644 .forgejo/workflows/test-and-deploy.yml
 create mode 100755 scripts/deploy-138.sh
 create mode 100755 scripts/test-138.sh

diff --git a/.forgejo/workflows/test-and-deploy.yml b/.forgejo/workflows/test-and-deploy.yml
new file mode 100644
index 0000000..d38656b
--- /dev/null
+++ b/.forgejo/workflows/test-and-deploy.yml
@@ -0,0 +1,24 @@
+name: test-and-deploy
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: 138
+    steps:
+      - uses: actions/checkout@v4
+      - name: Unit tests
+        run: bash scripts/test-138.sh
+
+  deploy-138:
+    needs: test
+    if: success() && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    runs-on: 138
+    steps:
+      - uses: actions/checkout@v4
+      - name: Deploy the host checkout
+        run: bash scripts/deploy-138.sh
diff --git a/scripts/deploy-138.sh b/scripts/deploy-138.sh
new file mode 100755
index 0000000..2d4206b
--- /dev/null
+++ b/scripts/deploy-138.sh
@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+# Test, build, and install the Linux verae-print binary on ns1.
+# Does not install a CUPS queue, and does not restart verae-timestamping-svc
+# or forgejo-runner. Does not read secret files.
+set -euo pipefail
+
+LOCK="${LOCK:-/tmp/verae-print-deploy.lock}"
+DEST="${DEST:-/opt/verae/printtoveraetimestamp}"
+BIN_LINK="${BIN_LINK:-/usr/local/bin/verae-print}"
+BACKUP_ROOT="${BACKUP_ROOT:-/SSD2/verae-deploy-backups}"
+GO_ROOT="${GO_ROOT:-/usr/local/lib/go1.26.9}"
+GO_TARBALL="${GO_TARBALL:-go1.26.9.linux-amd64.tar.gz}"
+GO_SHA256="${GO_SHA256:-42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d}"
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+mkdir -p "$(dirname "$LOCK")"
+exec 9>"$LOCK"
+if ! flock -w 900 9; then
+  echo "another print deploy holds the lock" >&2
+  exit 1
+fi
+
+prepare_cache() {
+  sudo mkdir -p "$BACKUP_ROOT/go-cache" "$BACKUP_ROOT/go-mod"
+  sudo chmod 1777 "$BACKUP_ROOT" "$BACKUP_ROOT/go-cache" "$BACKUP_ROOT/go-mod"
+  export GOCACHE="$BACKUP_ROOT/go-cache"
+  export GOMODCACHE="$BACKUP_ROOT/go-mod"
+  export GOPROXY="${GOPROXY:-https://proxy.golang.org,direct}"
+}
+
+ensure_go() {
+  if [[ -x "$GO_ROOT/bin/go" ]] && "$GO_ROOT/bin/go" version | grep -q 'go1.26.9 '; then
+    export PATH="$GO_ROOT/bin:$PATH"
+    return
+  fi
+  local tmp
+  tmp="$(mktemp -d)"
+  curl -fsSL -o "$tmp/go.tgz" "https://go.dev/dl/${GO_TARBALL}"
+  echo "${GO_SHA256}  ${tmp}/go.tgz" | sha256sum -c -
+  tar -C "$tmp" -xzf "$tmp/go.tgz"
+  sudo rm -rf "$GO_ROOT"
+  sudo mv "$tmp/go" "$GO_ROOT"
+  rm -rf "$tmp"
+  export PATH="$GO_ROOT/bin:$PATH"
+}
+
+run_tests() {
+  prepare_cache
+  ensure_go
+  cd "$ROOT"
+  go test ./... -count=1
+}
+
+install_tree() {
+  local built stage previous ts sha
+  ts="$(date -u +%Y%m%dT%H%M%SZ)"
+  sha="$(git -C "$ROOT" rev-parse HEAD)"
+  cd "$ROOT"
+  built="$(mktemp)"
+  go build -o "$built" ./cmd/verae-print
+  if ! grep -a -q 'verae-meta-git/1' "$built"; then
+    echo "built binary is missing verae-meta-git/1" >&2
+    rm -f "$built"
+    exit 1
+  fi
+  if ! "$built" version >/dev/null; then
+    echo "built binary failed version" >&2
+    rm -f "$built"
+    exit 1
+  fi
+  stage="$(mktemp -d "$BACKUP_ROOT/print-stage.XXXXXX")"
+  sudo rsync -a \
+    --exclude '.git/' \
+    --exclude 'bin/' \
+    "$ROOT/" "$stage/"
+  sudo mkdir -p "$stage/bin"
+  sudo cp "$built" "$stage/bin/verae-print"
+  sudo chmod 755 "$stage/bin/verae-print"
+  printf '%s\n' "$sha" | sudo tee "$stage/DEPLOYED_SHA" >/dev/null
+  rm -f "$built"
+  if ! sudo "$stage/bin/verae-print" version >/dev/null; then
+    sudo rm -rf "$stage"
+    echo "staged print binary failed version" >&2
+    return 1
+  fi
+  previous=""
+  if [[ -d "$DEST" ]]; then
+    previous="$BACKUP_ROOT/print-src-${ts}"
+    sudo mv "$DEST" "$previous"
+  fi
+  if ! sudo mv "$stage" "$DEST"; then
+    if [[ -n "$previous" ]]; then
+      sudo mv "$previous" "$DEST"
+    fi
+    echo "could not move the print checkout into place" >&2
+    return 1
+  fi
+  sudo ln -sfn "$DEST/bin/verae-print" "$BIN_LINK"
+  if ! "$BIN_LINK" version >/dev/null; then
+    echo "installed verae-print failed version" >&2
+    if [[ -n "$previous" ]]; then
+      sudo rm -rf "$DEST"
+      sudo mv "$previous" "$DEST"
+      sudo ln -sfn "$DEST/bin/verae-print" "$BIN_LINK"
+    fi
+    return 1
+  fi
+  echo "deployed ${ts} ${sha} version ok"
+}
+
+run_tests
+if [[ "${1:-}" == "--test-only" ]]; then
+  echo "tests ok"
+  exit 0
+fi
+
+install_tree
diff --git a/scripts/test-138.sh b/scripts/test-138.sh
new file mode 100755
index 0000000..76f6210
--- /dev/null
+++ b/scripts/test-138.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Unit-test PrintToVeraeTimeStamp. Does not install the binary.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+exec bash "$ROOT/scripts/deploy-138.sh" --test-only