chore(deploy): add pre-flight checks, dry-run mode, canary sync, path safety and fail-fast

[michaeljymsgutierrez]

Description

Improves the reliability, safety, and usability of deploy.sh. Adds pre-flight checks to block unauthorized or misconfigured deploys before anything runs, introduces a --dry-run mode to preview a release without executing it, fixes fragile directory navigation with absolute paths, syncs the missing canary staple branch during release cleanup, corrects the release branch naming convention, and adds set -euo pipefail for fail-fast behavior.

Github Issue: N/A

Changes

• deploy.sh - added set -euo pipefail to exit immediately on any command failure
• deploy.sh - added PROJECT_ROOT variable and replaced all fragile cd chains with absolute paths
• deploy.sh - added GIT_OWNER and NPM_OWNER constants for authorization checks
• deploy.sh - added run_cmd() helper to print or execute commands based on dry-run mode
• deploy.sh - added --dry-run / -d flag with yellow banner and v0.0.0-dry-run version placeholder
• deploy.sh - added check_dependencies() to verify jq, npm, yarn, git, awk are installed
• deploy.sh - added check_git_auth() to restrict deploys to the authorized git username
• deploy.sh - added check_npm_auth() to verify the correct npm user is logged in before publishing
• deploy.sh - fixed release branch prefix from releases/vX.X.X to release/vX.X.X per branch naming convention
• deploy.sh - added canary branch to sync_repository and cleanup_release_version_branch
• deploy.sh - changed exit 1 to return 1 in all check and validation functions for consistent Status: failed output
• deploy.sh - added || true to grep -v pipe to prevent pipefail false failures
• deploy.sh - added || true to read -p to handle non-interactive stdin safely
• deploy.sh - quoted $VERSION_TYPE argument in prepare_release_version call

Screenshots/Images

N/A

How Has This Been Tested?

• bash -n deploy.sh syntax check passes clean
• Dry-run mode manually verified: ./deploy.sh --dry-run stable:minor prints all steps without executing
• Script cannot be run end-to-end in isolation (touches remote branches and npm registry)

Checklist

• Code follows the project's coding standards and best practices.
• Existing tests pass.
• Documentation is updated to reflect changes.
• The PR is assigned to the correct reviewers.

Reviewer Guidance

• All destructive git, file, and npm commands are wrapped in run_cmd() - safe to verify by searching for run_cmd vs bare commands
• check_dependencies, check_git_auth, check_npm_auth all run before any git or file operations
• Release branch is now release/vX.X.X matching the branch naming convention in CONTRIBUTING.md
• canary is now synced on both sync_repository and cleanup_release_version_branch - was previously missing
• set -euo pipefail at line 2 ensures any uncaught failure halts the script immediately

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
arm-js-library-demo	Ready	Preview, Comment	Jun 30, 2026 5:32pm