From 3fbaf7f5ab9c9f62ee94afc34f4a3ef2b7fed573 Mon Sep 17 00:00:00 2001 From: Jonathon Leight Date: Thu, 27 Aug 2026 18:49:08 -0400 Subject: [PATCH] Add verify mise task --- .config/mise/config.toml | 18 +++++++++++++++++- README.md | 1 + 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/.config/mise/config.toml b/.config/mise/config.toml index 7769525..60f411c 100644 --- a/.config/mise/config.toml +++ b/.config/mise/config.toml @@ -7,7 +7,7 @@ go = "1.27.0" "golangci-lint" = "latest" pitchfork = "latest" -# Builds the OCI image (see .ko.yaml). Pinned for the same reason as Go. +jq = "latest" "aqua:ko-build/ko" = "0.19.1" [env] @@ -63,6 +63,22 @@ flag "-u --update" help="Rewrite THIRD-PARTY-NOTICES.md instead of only checking ''' run = 'go run ./cmd/licenses ${usage_update:+--update}' +# Compares the commit meshtender.com is running (from its public /version +# endpoint) with the commit checked out here, so you can tell at a glance +# whether this working directory is the deployed source. Exits non-zero if they +# differ, or if the deployed build reports no commit. +[tasks.verify] +run = """ +set -eu +deployed=$(curl -fsS https://meshtender.com/version | jq -r '.commit // empty') +[ -n "$deployed" ] || { echo "meshtender.com reports no commit"; exit 1; } +local=$(git rev-parse HEAD) +echo "deployed: $deployed" +echo "local: $local$(git diff --quiet HEAD || echo ' (uncommitted changes)')" +[ "$deployed" = "$local" ] || { echo "MISMATCH"; exit 1; } +echo "match" +""" + [tasks.seed] run = "go run ./cmd/meshtender --seed" diff --git a/README.md b/README.md index a1c2b8a..5d6782b 100644 --- a/README.md +++ b/README.md @@ -215,6 +215,7 @@ except users with credentials, passkeys, sessions, and the server identity. (Bot | `mise run e2e` | browser tests in a throwaway headless-shell container (`--run ` to filter) | | `mise run licenses` | audit dependency licenses (`--update` rewrites `THIRD-PARTY-NOTICES.md`) | | `mise run image` | build the OCI image with ko and print its digest (`--load` to run it locally) | +| `mise run verify` | compare the commit meshtender.com is running against the local checkout | ### Configuration (env)