We would like our deployment process to pull directly from our git
repository, but only activate new changes if they are signed (via
tag -s) with a GPG signature. I've found very few examples out there
of workflows that use GPG verification of git tags, so I'm not sure if
there's a "best practice" for this sort of thing.
What we have so far looks like this:
# discard erroneous local changes git reset --hard HEAD # get changes git fetch start=$(git rev-parse FETCH_HEAD) # get new tags git fetch --tags # find most recent release tag tag=$(git describe --abbrev=0 --match "release-*" $start) if git tag -v $tag; then git checkout $tag ...do stuff... fi
Does this make sense? In particular, in order to avoid erroneous
local changes from hosing the deployment process, is
git reset --hard
HEAD the right thing to do? Also, remembering
FETCH_HEAD seems to
be necessary, other wise tags subsequent to
HEAD don't show up in
the output of
git describe. Is there another way to do this?
Alternatively, if you have a documented deployment workflow that uses signed tags for verification I would be interested in a link to that.