bug: fix autodeploy

scripts/server-autodeploy.sh

@@ -6,12 +6,15 @@ mkdir -p "$STATE_DIR"
 exec 9>"$STATE_DIR/lock"
 flock -n 9 || { echo "another deploy running"; exit 0; }
 
+runas() { runuser -u "$REPO_OWNER" -- "$@"; }
+
 report_status() {
+  echo "updating status to: $1 - $2"
   [[ -f "$TOKEN_FILE" ]] || return 0
   curl -sf -X POST \
     -H "Authorization: token $(<"$TOKEN_FILE")" \
     -H "Content-Type: application/json" \
-    -d "$(jq -n --arg s "$1" --arg d "$2" --arg c "deploy/$(hostname)" \
+    -d "$(jq -n --arg s "$1" --arg d "$2" --arg c "deploy/$HOSTNAME" \
       '{state:$s,description:$d,context:$c}')" \
     "$GITEA_URL/api/v1/repos/$GITEA_REPO/statuses/$3" >/dev/null
 }
@@ -24,9 +27,9 @@ export GIT_CONFIG_VALUE_0=ssh
 export GIT_CONFIG_KEY_1=gpg.ssh.allowedSignersFile
 export GIT_CONFIG_VALUE_1="$ALLOWED_SIGNERS"
 
-git fetch origin --tags --prune-tags
+runas git fetch origin --tags --prune-tags
 
-latest=$(git describe --abbrev=0 "$BRANCH" 2>/dev/null) || {
+latest=$(runas git describe --abbrev=0 "$BRANCH" 2>/dev/null) || {
   echo "no tags on $BRANCH"
   exit 0
 }
@@ -36,17 +39,16 @@ current=$(cat "$STATE_DIR/tag" 2>/dev/null) || true
 
 echo "new tag: $latest (current: ${current:-none})"
 
-git tag -v "$latest" || {
-  sha=$(git rev-list -1 "$latest")
+runas git tag -v "$latest" || {
+  sha=$(runas git rev-list -1 "$latest")
   report_status "failure" "tag signature verification failed" "$sha"
   exit 1
 }
 
-sha=$(git rev-list -1 "$latest")
+sha=$(runas git rev-list -1 "$latest")
 report_status "pending" "deploying $latest" "$sha"
 
-# build from remote, pinned to the verified rev - no local checkout needed
-flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$(hostname)"
+flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$HOSTNAME"
 
 if nixos-rebuild switch --flake "$flake_url"; then
   echo "$latest" > "$STATE_DIR/tag"