From c45b4a43b499bfadddc48152734c7f304699ff34 Mon Sep 17 00:00:00 2001 From: EOEboh Date: Tue, 28 Jul 2026 13:27:17 +0100 Subject: [PATCH] fix(ci): allow deploying an arbitrary commit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rolling back is documented as re-running the deploy against the previous commit, and that did not work. actions/checkout defaults to a shallow fetch and resolves ref as a branch or tag glob, so a raw SHA fails: git fetch --depth=1 origin +refs/heads/*:... +refs/tags/*:... The process '/usr/bin/git' failed with exit code 1 fetch-depth: 0 fetches full history so a commit can be checked out. Found by actually running the rollback rather than trusting it. The run failed at checkout, long before the release step, so production was never touched — the same ordering that protected it when the image build failed. --- .github/workflows/deploy.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 1d90d6f..177b8b4 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -30,6 +30,10 @@ jobs: - uses: actions/checkout@v4 with: ref: ${{ inputs.ref }} + # Full history: the default shallow fetch resolves `ref` as a branch + # or tag glob, so an arbitrary commit SHA cannot be checked out — and + # deploying a specific commit is exactly how a rollback is performed. + fetch-depth: 0 - name: Record what is being deployed id: meta