Abort stale first deployments

deploy/scripts/upload-and-deploy.sh

@@ -79,6 +79,24 @@ revision="$(git -C "$WM_ROOT_DIR" rev-parse HEAD)"
 [[ "$revision" =~ ^[0-9a-f]{40}$ ]] ||
   wm_local_die "Aktueller Git-Commit konnte nicht als vollständige SHA ermittelt werden."
 
+origin_main_revision() {
+  local main_revision
+
+  main_revision="$(
+    git -C "$WM_ROOT_DIR" \
+      ls-remote --exit-code origin refs/heads/main |
+      awk 'NR == 1 { print $1 }'
+  )"
+  [[ "$main_revision" =~ ^[0-9a-f]{40}$ ]] ||
+    return 1
+  printf '%s\n' "$main_revision"
+}
+
+published_revision="$(origin_main_revision)" ||
+  wm_local_die "origin/main konnte nicht revisionsgenau gelesen werden."
+[[ "$published_revision" == "$revision" ]] ||
+  wm_local_die "Lokaler HEAD $revision ist nicht der aktuelle origin/main-Commit $published_revision."
+
 set -a
 # shellcheck disable=SC1090
 source "$local_env"
@@ -115,6 +133,7 @@ wait_for_remote_release() {
   local poll_seconds="${WATERMAPS_RELEASE_POLL_SECONDS:-15}"
   local deadline
   local attempts=0
+  local current_main_revision
   local remote_check
 
   [[ "$timeout_seconds" =~ ^[1-9][0-9]*$ ]] &&
@@ -142,6 +161,10 @@ wait_for_remote_release() {
 
     attempts=$((attempts + 1))
     if ((attempts == 1 || attempts % 4 == 0)); then
+      if current_main_revision="$(origin_main_revision 2>/dev/null)" &&
+        [[ "$current_main_revision" != "$expected_revision" ]]; then
+        wm_local_die "origin/main wurde während des Erstdeployments von $expected_revision auf $current_main_revision verschoben; starte den Livegang aus dem aktuellen main-Stand erneut."
+      fi
       printf '[watermaps] Das revisionsgenaue Erstdeployment läuft unter systemd; warte auf Commit %s …\n' \
         "$expected_revision"
     fi