No-op push can silently deploy the wrong branch #354

vkobel commented 2026年07月02日 17:31:56 +02:00

git push caution HEAD:main can redeploy a stale, unrelated branch instead of main when the push is a no-op.

Repro (actually hit, 2026年07月02日, pq-enclave-binding)

Local main and caution/main were both already 47b8d41, so git push caution HEAD:main sent no ref update. Server response:

remote: No branch updates received; redeploying existing remote HEAD 'test-deployments' at c96f7bf71676ad35928743be9b0a2f0b382a7658.
remote: Deploying branch 'test-deployments' at c96f7bf71676ad35928743be9b0a2f0b382a7658

test-deployments deployed instead of main — silently, no error, no confirmation.

Cause

src/gateway/src/ssh_server.rs:689-731 (pre-fix). A no-op push sends zero ref-update lines to receive-pack — the server has no record of which ref the client requested. On PushedBranchSelection::None, the gateway fell back to the bare repo's stored HEAD symref (get_repo_head_branch), which reflects whatever branch was last deployed, not the branch just pushed.

Impact

A routine, already-up-to-date push can redeploy a different, older branch with no error and no confirmation — silent wrong-environment deploy.

`git push caution HEAD:main` can redeploy a stale, unrelated branch instead of `main` when the push is a no-op. ## Repro (actually hit, 2026年07月02日, pq-enclave-binding) Local `main` and `caution/main` were both already `47b8d41`, so `git push caution HEAD:main` sent no ref update. Server response: remote: No branch updates received; redeploying existing remote HEAD 'test-deployments' at c96f7bf71676ad35928743be9b0a2f0b382a7658. remote: Deploying branch 'test-deployments' at c96f7bf71676ad35928743be9b0a2f0b382a7658 `test-deployments` deployed instead of `main` — silently, no error, no confirmation. ## Cause `src/gateway/src/ssh_server.rs:689-731` (pre-fix). A no-op push sends zero ref-update lines to `receive-pack` — the server has no record of which ref the client requested. On `PushedBranchSelection::None`, the gateway fell back to the bare repo's stored `HEAD` symref (`get_repo_head_branch`), which reflects whatever branch was *last deployed*, not the branch just pushed. ## Impact A routine, already-up-to-date push can redeploy a different, older branch with no error and no confirmation — silent wrong-environment deploy.

vkobel commented 2026年07月02日 17:47:29 +02:00

Realizing it's more of a git limitation actually, also git push caution HEAD:main --force is a decent workaround

Realizing it's more of a git limitation actually, also `git push caution HEAD:main --force` is a decent workaround