Fix deploy symlink step for Gitea Actions runner.

Remove stale current symlink before promoting release and document
passwordless sudo fallback for deploy user.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/deploy.sh

@@ -239,15 +239,20 @@ if ! run_artisan "migrate --force"; then
 fi
 
 switch_current_release() {
+  # Remove a root-owned symlink left from manual bootstrap so deploy can replace it.
+  if [ -e "$CURRENT_LINK" ] || [ -L "$CURRENT_LINK" ]; then
+    rm -f "$CURRENT_LINK" 2>/dev/null || true
+  fi
+
   if ln -sfnT "$NEW_RELEASE" "$CURRENT_LINK" 2>/dev/null; then
     return 0
   fi
 
-  if command -v sudo >/dev/null 2>&1 && sudo -n ln -sfnT "$NEW_RELEASE" "$CURRENT_LINK"; then
+  if command -v sudo >/dev/null 2>&1 && sudo -n rm -f "$CURRENT_LINK" && sudo -n ln -sfnT "$NEW_RELEASE" "$CURRENT_LINK"; then
     return 0
   fi
 
-  echo "Unable to update current release symlink at $CURRENT_LINK" >&2
+  echo "Unable to update current release symlink at $CURRENT_LINK (ensure $APP_ROOT is owned by the deploy user)" >&2
   return 1
 }
 

deployment/sudoers.ladill-care-deploy.example

@@ -0,0 +1,3 @@
+# Allow the deploy user to switch ladill-care releases without a password.
+# Required only if APP_ROOT was bootstrapped as root (e.g. manual first deploy).
+deploy ALL=(ALL) NOPASSWD: /bin/ln -sfnT /var/www/ladill-care/releases/* /var/www/ladill-care/current, /bin/rm -f /var/www/ladill-care/current