chore: add upstream update helper

WIMBY.md

@@ -12,13 +12,18 @@ The local clone is expected to have:
 Update with:
 
 ```sh
-git fetch upstream
-git checkout main
-git rebase upstream/main
-git push origin main
+./scripts/update-from-upstream.sh
 ```
 
-If upstream changes the same code, resolve the rebase conflict and keep only the local behavior that is still required.
+The script requires a clean `main`, fetches both remotes, rebases the local patch series onto `upstream/main`, and pushes with a guarded `--force-with-lease`. It refuses to push if `origin/main` changed after the fetch.
+
+To rebase locally for inspection without pushing:
+
+```sh
+./scripts/update-from-upstream.sh --no-push
+```
+
+If upstream changes the same code, the script stops on the rebase conflict and does not push. Resolve the conflict and continue with `git rebase --continue`, or restore the pre-update state with `git rebase --abort`.
 
 A push to `main` builds and publishes:
 

scripts/update-from-upstream.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: scripts/update-from-upstream.sh [--no-push]
+
+Update the Wimby TubeSync fork from upstream/main while preserving the local
+patch series as rebased commits. By default the updated main branch is pushed
+to origin with a guarded --force-with-lease.
+
+Options:
+  --no-push  Rebase locally but do not push origin/main.
+  -h, --help Show this help.
+EOF
+}
+
+push=true
+case "${1:-}" in
+  "") ;;
+  --no-push) push=false ;;
+  -h|--help) usage; exit 0 ;;
+  *) echo "Unknown argument: $1" >&2; usage >&2; exit 2 ;;
+esac
+
+repo_root="$(git rev-parse --show-toplevel 2>/dev/null)" || {
+  echo "Not inside a Git repository." >&2
+  exit 1
+}
+cd "$repo_root"
+
+for remote in origin upstream; do
+  if ! git remote get-url "$remote" >/dev/null 2>&1; then
+    echo "Required remote '$remote' is missing." >&2
+    exit 1
+  fi
+done
+
+if [ -n "$(git status --porcelain)" ]; then
+  echo "Working tree is not clean; commit or stash changes first." >&2
+  git status --short >&2
+  exit 1
+fi
+
+if [ -d .git/rebase-merge ] || [ -d .git/rebase-apply ]; then
+  echo "A rebase is already in progress; finish or abort it first." >&2
+  exit 1
+fi
+
+echo "Fetching origin and upstream..."
+git fetch --prune origin
+git fetch --prune upstream
+
+git switch main
+
+origin_sha="$(git rev-parse origin/main)"
+local_sha="$(git rev-parse main)"
+
+if [ "$local_sha" != "$origin_sha" ]; then
+  echo "Local main does not exactly match origin/main." >&2
+  echo "  local:  $local_sha" >&2
+  echo "  origin: $origin_sha" >&2
+  echo "Refusing to rebase until the discrepancy is resolved." >&2
+  exit 1
+fi
+
+upstream_sha="$(git rev-parse upstream/main)"
+echo "origin/main:   $origin_sha"
+echo "upstream/main: $upstream_sha"
+
+echo
+echo "Local commits currently carried on top of upstream:"
+git log --oneline --reverse upstream/main..main || true
+
+echo
+echo "Rebasing local patch series onto upstream/main..."
+if ! git rebase upstream/main; then
+  cat >&2 <<'EOF'
+
+Rebase stopped on a conflict.
+Resolve the files, then run:
+  git add <resolved-files>
+  git rebase --continue
+
+Or abandon the update with:
+  git rebase --abort
+
+Nothing was pushed.
+EOF
+  exit 1
+fi
+
+new_sha="$(git rev-parse main)"
+echo
+echo "Updated main: $new_sha"
+echo "Patch series after rebase:"
+git log --oneline --reverse upstream/main..main || true
+
+if ! $push; then
+  echo
+echo "--no-push requested; origin/main was not changed."
+  exit 0
+fi
+
+if [ "$new_sha" = "$origin_sha" ]; then
+  echo
+echo "Already up to date; nothing to push."
+  exit 0
+fi
+
+echo
+echo "Pushing rebased main with a guarded force-with-lease..."
+git push \
+  --force-with-lease="refs/heads/main:${origin_sha}" \
+  origin main
+
+echo
+echo "Done. Gitea Actions should now build and publish the updated image."