Abort stale first deployments

deploy/scripts/tests/upload-and-deploy.test.sh

@@ -52,6 +52,9 @@ case "$*" in
   *"rev-parse HEAD"*)
     printf '%s\n' "$FAKE_REVISION"
     ;;
+  *"ls-remote --exit-code origin refs/heads/main"*)
+    printf '%s\trefs/heads/main\n' "$FAKE_MAIN_REVISION"
+    ;;
   *)
     printf 'Unerwarteter Git-Aufruf: %s\n' "$*" >&2
     exit 90
@@ -92,6 +95,7 @@ output="$(
   FAKE_CALL_LOG="$FAKE_LOG" \
   FAKE_CHECK_COUNT="$CHECK_COUNT" \
   FAKE_REVISION="$REVISION" \
+  FAKE_MAIN_REVISION="$REVISION" \
   WATERMAPS_RELEASE_WAIT_SECONDS=60 \
   WATERMAPS_RELEASE_POLL_SECONDS=5 \
     "$UPLOAD_SCRIPT" \
@@ -117,4 +121,26 @@ assert_contains \
   "$output"
 assert_contains "sleep|5" "$(<"$FAKE_LOG")"
 
+NEWER_REVISION="4444444444444444444444444444444444444444"
+set +e
+mismatch_output="$(
+  PATH="$FAKE_BIN:$PATH" \
+  FAKE_CALL_LOG="$FAKE_LOG" \
+  FAKE_CHECK_COUNT="$CHECK_COUNT" \
+  FAKE_REVISION="$REVISION" \
+  FAKE_MAIN_REVISION="$NEWER_REVISION" \
+    "$UPLOAD_SCRIPT" \
+      --host 203.0.113.10 \
+      --identity "$TEST_IDENTITY" \
+      2>&1
+)"
+mismatch_status=$?
+set -e
+
+[[ "$mismatch_status" -ne 0 ]] ||
+  fail "Ein nicht veröffentlichter lokaler HEAD wurde für das Deployment akzeptiert."
+assert_contains \
+  "Lokaler HEAD $REVISION ist nicht der aktuelle origin/main-Commit $NEWER_REVISION." \
+  "$mismatch_output"
+
 printf 'Upload/Erstdeployment: systemd-Start und revisionsgenaues Warten: OK\n'