#!/usr/bin/env bash
set -Eeuo pipefail

read -r command sha extra <<<"${SSH_ORIGINAL_COMMAND:-}"
[[ $command == deploy-deconto && $sha =~ ^[0-9a-f]{40}$ && -z ${extra:-} ]] || {
  echo "command not allowed" >&2
  exit 2
}
exec /usr/local/sbin/audax-deploy-deconto "$sha"