# Production deploy scripts — which file to use

These scripts are **pasted into the Jenkins job by hand** (job
`erp-frontend-pipeline-production`, "Execute shell" step). Nothing here is pulled
or executed from the repo; the copies exist for version history and rollback.

| File | Role |
|---|---|
| `deploy-production.sh` | **The one to paste into Jenkins.** Always the newest version — edit THIS file when the deploy needs a change. |
| `latest-working-jenkins-production.sh` | **Snapshot of what Jenkins is running right now** (= the last version that deployed successfully). Rollback copy — never edit it by hand. |

## Workflow for every deploy-script change

1. Copy the current script **from Jenkins** over `latest-working-jenkins-production.sh`
   (so the snapshot really matches production; diff it against the repo copy — if it
   differs, someone edited Jenkins directly and that change must be merged into
   `deploy-production.sh` first).
2. Make the change in `deploy-production.sh`, run `bash -n reference/ci/deploy-production.sh`.
3. Paste `deploy-production.sh` into the Jenkins job and deploy.
4. After a successful deploy: `cp deploy-production.sh latest-working-jenkins-production.sh`
   and commit both.

If a deploy breaks, paste `latest-working-jenkins-production.sh` back into Jenkins.

## What must never be dropped from the script

- `DB_FILES` / `DATA_EXTRA` — every SQLite DB and runtime file under `data/` that has to
  survive the `rm -rf $LIVE_DIR`. Adding a new `data/*.db` or `data/<dir>` in the app
  WITHOUT listing it here means it is wiped on the next deploy.
- `npm rebuild better-sqlite3` inside `.output/server` (native module, Node ABI).
- The "COPY RUNTIME ASSETS" block (tesseract wasm, pdfjs worker, canvas fallback) —
  the incoming-invoice OCR breaks silently without it.
- The pm2 systemd drop-in (`After=idempiere.service` + PATH) — keep in sync with
  `deploy/pm2-root.service.d/override.conf`.