This will only spot uncommitted changes to tracked files. I want a completely clean repository before I deploy, where there are neither uncommitted changes to tracked files, nor (new) untracked files.
But no, I did not know of git-sh-setup, thanks for the tip :-)
If that's your goal, it might be better to just never deploy from a checked out repository and instead always make a new copy of the code (git clone, git archive, download the tarball from github etc). As in, make the deploy script do that for you, so you never even get into a situation where you could have a dirty working tree in the first place.
You could take it a step further and setup a dead simple server that does it for you and tracks the results in a central place for the whole team. With a manual trigger if you so desired.
But no, I did not know of git-sh-setup, thanks for the tip :-)