Show build info in header

Deploy the CI-built wheel for the triggering SHA so the UI and\nbuild metadata stay in sync in production.

tests/test_deploy_scripts.py

@@ -57,6 +57,36 @@ def test_repo_upgrade_forces_fresh_install_without_skipping_dependencies():
 
     assert "pip\" install --upgrade --force-reinstall --no-cache-dir" in script
     assert "--no-deps" not in script
+    assert '"${WHEEL:-$REPO_DIR}"' in script
+
+
+def test_deploy_workflow_pins_built_wheel_to_triggering_revision():
+    workflow = (Path(__file__).parents[1] / ".gitea/workflows/deploy.yml").read_text()
+
+    assert "actions/upload-artifact@v4" in workflow
+    assert "actions/download-artifact@v4" in workflow
+    assert "scp -P" in workflow
+    assert "DEPLOY_SHA: ${{ github.sha }}" in workflow
+    assert "git checkout --detach $DEPLOY_SHA" in workflow
+    assert "repo-upgrade.sh /tmp/importarr-deploy.whl $DEPLOY_SHA" in workflow
+
+
+def test_deploy_workflow_cleans_up_without_masking_deployment_failure():
+    workflow = (Path(__file__).parents[1] / ".gitea/workflows/deploy.yml").read_text()
+
+    capture = "|| deploy_status=\\$?;"
+    cleanup = "rm -f /tmp/importarr-deploy.whl;"
+    propagate = "exit \\$deploy_status"
+    assert "deploy_status=0; sudo" in workflow
+    assert workflow.index(capture) < workflow.index(cleanup) < workflow.index(propagate)
+
+
+def test_repo_upgrade_uses_pinned_revision_for_build_metadata():
+    script = (Path(__file__).parents[1] / "deploy/repo-upgrade.sh").read_text()
+
+    assert 'test "$(git rev-parse HEAD)" = "$(git rev-parse "$REVISION^{commit}")"' in script
+    assert 'GIT_SHA="$(git rev-parse --short=12 HEAD' in script
+    assert 'VERSION="$(git rev-parse --short=12 HEAD)"' in script
 
 
 def test_repo_upgrade_deploys_only_origin_main():