Fix devtoprod git step exit-code handling

Add Invoke-Git with safe external command execution and stop using prod LAN URL for dev validateBuild checks.

Co-authored-by: Cursor <cursoragent@cursor.com>

infra/deploy/devtoprod.config.example.json

@@ -29,6 +29,7 @@
     "password": ""
   },
   "verify": {
+    "devLanUrl": "http://192.168.10.70:5173/api/bounds",
     "devUrl": "https://devgallery.mysuperlab.netcraze.pro/api/bounds",
     "lanUrl": "http://192.168.10.122:5173/api/bounds",
     "publicUrl": "https://gallery.mysuperlab.netcraze.pro/api/bounds"

infra/scripts/deploy-dev-to-prod.ps1

@@ -55,22 +55,41 @@ function Invoke-Npm {
         $npmArgs += '--'
         $npmArgs += $ExtraArgs
     }
-    # Important: callers assign the return value of this function to a variable
-    # (e.g. `$code = Invoke-Npm 'prod:build'`).
-    # If npm output is sent to the pipeline, PowerShell can accidentally capture
-    # stdout/stderr along with the function return value, breaking exit-code logic.
-    # So we stream npm output to $null and return only the exit code.
     Write-Host ("Running npm: npm " + ($npmArgs -join ' ')) -ForegroundColor DarkGray
-    # Capture stdout/stderr so the function does not emit pipeline output.
+    return Invoke-ExternalCommand -Name 'npm' -CommandArgs $npmArgs
+}
+
+function Invoke-Git {
+    param([string[]]$GitArgs)
+    Write-Host ("Running git: git " + ($GitArgs -join ' ')) -ForegroundColor DarkGray
+    return Invoke-ExternalCommand -Name 'git' -CommandArgs $GitArgs
+}
+
+function Get-GitPorcelainStatus {
     $prevEap = $ErrorActionPreference
     $ErrorActionPreference = 'Continue'
-    $npmOutput = & npm @npmArgs 2>&1
+    $output = & git status --porcelain 2>&1
+    $ErrorActionPreference = $prevEap
+    return ($output | Out-String).Trim()
+}
+
+function Invoke-ExternalCommand {
+    param(
+        [string]$Name,
+        [string[]]$CommandArgs
+    )
+
+    # Capture stdout/stderr so callers assigning the return value only get exit code.
+    $prevEap = $ErrorActionPreference
+    $ErrorActionPreference = 'Continue'
+    $output = & $Name @CommandArgs 2>&1
+    $exit = $LASTEXITCODE
     $ErrorActionPreference = $prevEap
 
-    foreach ($line in $npmOutput) {
+    foreach ($line in $output) {
         Write-Host $line
     }
-    return $LASTEXITCODE
+    return $exit
 }
 
 function Invoke-Step {
@@ -93,6 +112,7 @@ function Invoke-Step {
             $code = if ($null -ne $LASTEXITCODE) { $LASTEXITCODE } else { 0 }
         }
         if ($code -ne 0) {
+            Write-Host ("Step failed with exit code: " + $code) -ForegroundColor Red
             $script:FailedStep = $Name
             return $false
         }
@@ -259,15 +279,13 @@ Write-Host ('Steps: ' + ($enabled -join ', '))
 if (Get-StepEnabled $steps 'validateBuild') {
     $ok = Invoke-Step 'validateBuild' {
         $code = Invoke-Npm 'prod:build'
-        Write-Host ("prod:build exit code: " + $code)
         if ($code -ne 0) { return $code }
 
-        # Always prefer the dev host on LAN (192.168.10.70) because the HTTPS dev domain
-        # can return transient 504 HTML pages during load.
-        $devCandidates = @()
+        # Dev-only endpoints. Do not use verify.lanUrl here (that is prod on TrueNAS).
+        $devCandidates = @(
+            'http://192.168.10.70:5173/api/bounds'
+        )
         if ($cfg.verify.devLanUrl) { $devCandidates += $cfg.verify.devLanUrl }
-        $devCandidates += 'http://192.168.10.70:5173/api/bounds'
-        if ($cfg.verify.lanUrl) { $devCandidates += $cfg.verify.lanUrl }
         if ($cfg.verify.devUrl) { $devCandidates += $cfg.verify.devUrl }
         $devCandidates = $devCandidates | Select-Object -Unique
 
@@ -299,20 +317,20 @@ if (Get-StepEnabled $steps 'gitCommitPush') {
         $stageAll = if ($null -ne $cfg.git.stageAll) { [bool]$cfg.git.stageAll } else { $true }
 
         if ($stageAll) {
-            git add -A
-            if ($LASTEXITCODE -ne 0) { return $LASTEXITCODE }
+            $code = Invoke-Git @('add', '-A')
+            if ($code -ne 0) { return $code }
         }
 
-        $status = git status --porcelain
+        $status = Get-GitPorcelainStatus
         if (-not $status) {
             Write-Host 'Git: working tree clean, skipping commit.'
         } else {
-            git commit -m $message
-            if ($LASTEXITCODE -ne 0) { return $LASTEXITCODE }
+            $code = Invoke-Git @('commit', '-m', $message)
+            if ($code -ne 0) { return $code }
         }
 
-        git push origin $branch
-        if ($LASTEXITCODE -ne 0) { return $LASTEXITCODE }
+        $code = Invoke-Git @('push', 'origin', $branch)
+        if ($code -ne 0) { return $code }
         return 0
     }
     if (-not $ok) { Write-ReleaseBanner -Success $false -FailedAt $FailedStep; exit 1 }