We would like our deployment process to pull directly from our git
repository, but only activate new changes if they are signed (via git
tag -s
) with a GPG signature. I've found very few examples out there
of workflows that use GPG verification of git tags, so I'm not sure if
there's a "best practice" for this sort of thing.
What we have so far looks like this:
# discard erroneous local changes
git reset --hard HEAD
# get changes
git fetch
start=$(git rev-parse FETCH_HEAD)
# get new tags
git fetch --tags
# find most recent release tag
tag=$(git describe --abbrev=0 --match "release-*" $start)
if git tag -v $tag; then
git checkout $tag
...do stuff...
fi
Does this make sense? In particular, in order to avoid erroneous
local changes from hosing the deployment process, is git reset --hard
HEAD
the right thing to do? Also, remembering FETCH_HEAD
seems to
be necessary, other wise tags subsequent to HEAD
don't show up in
the output of git describe
. Is there another way to do this?
Alternatively, if you have a documented deployment workflow that uses signed tags for verification I would be interested in a link to that.