Fix deploy step: git reset --hard destroys .env and local state #38

New Issue

kert · 2026-03-13T14:33:45Z

kert commented

2026-03-13 14:33:45 +00:00

Problem

The deploy step runs git reset --hard FETCH_HEAD which deletes any files not in the repo, including .env (containing all service passwords, S3 credentials, COMMIT_SHA). The subsequent sed on .env either fails or creates an incomplete .env with only COMMIT_SHA.

This is a data-loss bug — deploying destroys the credentials file that all services need.

Fix

Replace git reset --hard with git fetch && git merge --ff-only FETCH_HEAD which fails safely if there are conflicts instead of silently destroying state. Or backup/restore .env:

cp .env .env.bak 2>/dev/null || true
git fetch && git reset --hard FETCH_HEAD
cp .env.bak .env 2>/dev/null || true

Acceptance criteria

.env file survives deploy step with all existing variables intact
COMMIT_SHA is correctly updated
data/ directory and other local-only files are preserved

## Problem The deploy step runs `git reset --hard FETCH_HEAD` which deletes any files not in the repo, including `.env` (containing all service passwords, S3 credentials, COMMIT_SHA). The subsequent `sed` on `.env` either fails or creates an incomplete `.env` with only `COMMIT_SHA`. This is a **data-loss bug** — deploying destroys the credentials file that all services need. ## Fix Replace `git reset --hard` with `git fetch && git merge --ff-only FETCH_HEAD` which fails safely if there are conflicts instead of silently destroying state. Or backup/restore `.env`: ```shell cp .env .env.bak 2>/dev/null || true git fetch && git reset --hard FETCH_HEAD cp .env.bak .env 2>/dev/null || true ``` ## Acceptance criteria - `.env` file survives deploy step with all existing variables intact - `COMMIT_SHA` is correctly updated - `data/` directory and other local-only files are preserved

kert added this to the P9: CI/CD Unification milestone 2026-03-13 14:33:45 +00:00

kert added the quality label 2026-03-13 14:33:45 +00:00

kert referenced this issue from a commit

2026-03-13 14:37:40 +00:00

P9 CI/CD unification: fix broken pipelines, harden deploy (fix #36, fix #37, fix #38, fix #39, fix #40, fix #41)

kert closed this issue

2026-03-13 14:37:40 +00:00

Sign in to join this conversation.