From 47405e5334e0122e072034e95b9297c11d01c859 Mon Sep 17 00:00:00 2001
From: Pontoporeia <pontoporeia@happyngreen.fr>
Date: Wed, 20 May 2026 12:58:31 +0200
Subject: [PATCH] Fix: split deploy recipe into
 deploy-code/deploy-deps/deploy-migrate; deploy-deps always syncs
 composer.json+composer.lock, runs composer install only when lockfile
 checksum changed

---
 TODO.md  |  2 +-
 justfile | 39 ++++++++++++++++++++++++++++-----------
 2 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/TODO.md b/TODO.md
index 6240798..615a77f 100644
--- a/TODO.md
+++ b/TODO.md
@@ -164,7 +164,7 @@
 # Current tasks
 
 - [x] Add ZipArchive guard to legacy export-files.php
-- [x] Add composer install --no-dev step to deploy recipe + composer.json/composer.lock rsync (vendor/ excluded from rsync, de-librairisation requires Composer deps on server; composer.json lives in repo root, deploy only syncs app/)
+- [x] Refactor deploy recipe: split into deploy-code / deploy-deps / deploy-migrate; deploy-deps always syncs composer.json+composer.lock, runs composer install only when lockfile checksum changed
 
 - [x] Cleanup modal: list files that will be removed (not just counts)
 - [x] Storage restructure: documents/ → {objet}/ (tfe/theses/frart)
diff --git a/justfile b/justfile
index 53cb433..f9d33dd 100644
--- a/justfile
+++ b/justfile
@@ -37,8 +37,16 @@ logs:
 # ============================================================================
 
 [group('deploy')]
-deploy:
-    # Main deploy (code + assets) then run any pending DB migrations
+deploy: deploy-code deploy-deps deploy-migrate
+    @just deploy-env
+    @just deploy-verify-permissions
+    @echo ""
+    @echo "ℹ️  First deploy? Also run: just deploy-backup"
+    @echo ""
+
+[group('deploy')]
+deploy-code:
+    # Sync app code + nginx config + permissions (no Composer deps, no migrations)
     rsync -vur --progress --delete \
         --chown="www-data:xamxam" \
         --exclude '/vendor' \
@@ -75,19 +83,28 @@ deploy:
     ssh -t xamxam "sudo bash /tmp/deploy-server.sh"
     ssh xamxam "rm -f /tmp/deploy-server.sh /tmp/xamxam.conf"
     ssh xamxam "mkdir -p /var/www/xamxam/var/{cache,logs,tmp}"
-    # Install/update Composer dependencies (vendor/ excluded from rsync above)
+
+[group('deploy')]
+deploy-deps:
+    # Sync composer.json + composer.lock to server, then run composer install
+    # (only if composer.lock checksum changed — skip expensive install otherwise)
     rsync -v composer.json composer.lock xamxam:/var/www/xamxam/
-    ssh xamxam "cd /var/www/xamxam && composer install --no-dev --no-interaction --optimize-autoloader"
-    # Run pending migrations (creates DB from schema if missing, idempotent)
+    ssh xamxam 'cd /var/www/xamxam && \
+        if [ ! -f vendor/.composer-lock-checksum ] || \
+           [ "$(sha256sum composer.lock | cut -d" " -f1)" != "$(cat vendor/.composer-lock-checksum)" ]; then \
+            echo "→ composer.lock changed, installing dependencies…"; \
+            composer install --no-dev --no-interaction --optimize-autoloader && \
+            sha256sum composer.lock | cut -d" " -f1 > vendor/.composer-lock-checksum; \
+        else \
+            echo "→ composer.lock unchanged, skipping composer install"; \
+        fi'
+
+[group('deploy')]
+deploy-migrate:
+    # Run pending DB migrations (creates DB from schema if missing, idempotent)
     rsync -v scripts/migrate.sh xamxam:/tmp/migrate.sh
     ssh xamxam "cd /var/www/xamxam && REPO_ROOT=/var/www/xamxam bash /tmp/migrate.sh"
     ssh xamxam "rm -f /tmp/migrate.sh"
-    # Sync .env separately (excluded above to avoid accidental overwrite on subsequent deploys)
-    @just deploy-env
-    @just deploy-verify-permissions
-    @echo ""
-    @echo "ℹ️  First deploy? Also run: just deploy-backup"
-    @echo ""
 
 [group('deploy')]
 deploy-env: