feat(cli): harper deploy by_ref=true — deploy by git+https reference (+ credential)#1850
Draft
dawsontoth wants to merge 3 commits into
Draft
feat(cli): harper deploy by_ref=true — deploy by git+https reference (+ credential)#1850dawsontoth wants to merge 3 commits into
harper deploy by_ref=true — deploy by git+https reference (+ credential)#1850dawsontoth wants to merge 3 commits into
Conversation
…+ credential) When no `package=` is given and `by_ref=true` (or `ref=<committish>`) is passed, the CLI resolves the app's GitHub owner/repo and commit (HEAD or GITHUB_SHA) from the local working copy, warns on a dirty tree, defaults `project` from package.json, and deploys `git+https://github.com/<owner>/<repo>.git#<sha>`. Pinning by SHA keeps cluster peers from diverging on a moved tag. For a private repo, `credential=github.com` (or `credential=true`) attaches a `credentials` reference [{host, secret: deploy.<component>.<host>}] — the sealed token provisioned once by `harper deploy setup=true` — which the cluster resolves in-memory to authenticate the HTTPS clone (#1799). A public repo needs no credential. No-flag default stays the payload deploy. by_ref/ref/credential are transport-only; credentials (plural) is a real field and is sent. Relates to #1777, #1799, #641. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces a "deploy-by-reference" feature that allows deploying a pinned Git commit directly by reference instead of uploading a payload blob. The feedback points out an issue in resolveGitCommittish where numeric git references (such as numeric SHAs or tags) parsed as numbers would be ignored due to a strict string type check, and provides a suggestion to convert them to strings.
This was referenced Jul 17, 2026
Draft
Draft
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
Contributor
|
Reviewed; no blockers found. Both prior blockers (numeric-ref coercion, missing tests) are resolved in 2f12b9f. |
…<host>) The credential= reference must resolve to the same hdb_secret row that `harper deploy setup=true` seals (and a literal-token deploy would auto-name). Renamed the derivation to deriveGitSecretName, mirroring the server's exactly (the .git. segment + normalizeGitHost). Keeps by_ref (#1850) and deploy setup (#1851) consistent with core. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tests resolveGitCommittish accepts a number (buildRequest JSON-parses ref=1234567 to a number) and coerces it to a string instead of ignoring it and falling back to GITHUB_SHA/HEAD. Extracted the by_ref branch into an exported prepareDeployByRef(req) (plus exported resolveGitCommittish/deriveGitSecretName) for testability. Added unit tests covering the git+https package build, ref override, numeric-ref coercion, credential=true/<host> reference derivation, and the deploy.<component>.git.<host> secret name. Addresses the harper#1850 review (12/12 unit tests pass). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
harper deploy by_ref=true(orref=<committish>) resolves the app's GitHubowner/repo+ commit from the local working copy (or GitHub ActionsGITHUB_REPOSITORY/GITHUB_SHA) and deploysgit+https://github.com/<owner>/<repo>.git#<sha>instead of packaging a payload blob. Pinning by SHA keeps cluster peers from diverging on a moved tag.For a private repo,
credential=github.com(orcredential=true) attaches acredentialsreference[{ host, secret: "deploy.<component>.<host>" }]— the durable token sealed once byharper deploy setup=true(#1778) — which the cluster resolves in-memory to authenticate the HTTPS clone (#1799). Public repos need no credential.Where:
bin/cliOperations.ts,PREPARE_OPERATION.deploy_component. The no-flag default stays the payload deploy (backward-compatible).by_ref/ref/credentialare transport-only (consumed client-side);credentialsis a real operation field and is sent. Parse + oxlint + prettier clean.Refs #1777, #1799, #641.
Related — deploy-by-reference effort
Prototype PRs: #1850 (deploy by_ref) · #1851 (deploy setup) · HarperFast/harper-pro#594 (add_ssh_key generate) · HarperFast/create-harper#118 (create-harper scaffold)
Tracking issues: #1777 · #1778 · HarperFast/harper-pro#570 · HarperFast/create-harper#117 · #641 (rollback)