From ab5e963b830b620e7e8b3e0b1565f38ef192c42c Mon Sep 17 00:00:00 2001 From: ogt Date: Sat, 11 Jul 2026 00:47:47 +0800 Subject: [PATCH] fix(cd): keep deploy checkout on main ref --- .gitea/workflows/cd.yaml | 3 ++- apps/api/tests/test_signal_worker_ansible_executor_binding.py | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml index 92e2e6dee..0310798b3 100644 --- a/.gitea/workflows/cd.yaml +++ b/.gitea/workflows/cd.yaml @@ -1311,7 +1311,8 @@ jobs: git remote remove origin 2>/dev/null || true git remote add origin "$GITEA_SOURCE_URL" git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" - git checkout --force --detach FETCH_HEAD + # Deploy marker creation and push require a real local main ref. + git checkout --force -B main FETCH_HEAD - name: Wait for Host Web Build Pressure # 2026-06-27 Codex: post-deploy smoke is also browser-heavy. Refuse to diff --git a/apps/api/tests/test_signal_worker_ansible_executor_binding.py b/apps/api/tests/test_signal_worker_ansible_executor_binding.py index 415a53f07..274ba7b90 100644 --- a/apps/api/tests/test_signal_worker_ansible_executor_binding.py +++ b/apps/api/tests/test_signal_worker_ansible_executor_binding.py @@ -115,6 +115,7 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None: assert "delete pods --all-namespaces" in workflow assert "repair-ssh-key|repair-known-hosts|ssh-mcp-key" in workflow assert "github.com/kubernetes-sigs/kustomize" not in workflow + assert "git checkout --force -B main FETCH_HEAD" in workflow def test_gitea_workflows_never_download_github_actions() -> None: