Refuse to deploy from a stale or dirty working copy

[Ngonie69]

Why

Update-Production.ps1 publishes whatever is in the local working copy. Merging a PR on the remote does not update that copy, so a checkout left behind origin publishes pre-fix code while reporting a clean, successful deployment.

That is not hypothetical — it is how the merged drawer fix in #22 reached production without taking effect. The deploy was correct; the source wasn't.

What

Assert-SourceUpToDate, run before any publish:

• Blocks on uncommitted changes — published output would match no commit in history
• Blocks when the branch is behind its origin counterpart
• Warns on unpushed local commits, and prints the revision being deployed
• Degrades to a warning when git is unavailable, the tree is not a repo, HEAD is detached, or origin is unreachable — none of these should hard-block a deploy

Skipped for -RestartOnly (nothing is published). Overridable with -SkipGitCheck, which is forwarded to elevated and per-server child invocations so the check runs once in the parent rather than per server.

Testing

Function extracted and exercised against real repo states:

Case	Result
Clean, up to date	Passes, prints branch + revision
One commit behind origin (the #22 outage)	Blocked, with the git pull --ff-only remedy
Uncommitted changes	Blocked, lists the dirty files
-SkipGitCheck	Skips with a notice
Not a git repo	Warns, continues

Script parses clean ([Parser]::ParseFile, 0 errors). Test scaffolding removed.

Note this file is not itself deployed — it is the thing doing the deploying, so the guard takes effect on the next run after merge.

🤖 Generated with Claude Code