Commit changes check broken since #980 ?

[jrehwaldt]

Description

Hi.

I just installed doco-cd this weekend, so maybe I am missing something completely. It seems that doco-cd does not pull (or fetch) updates from GitHub anymore since #980.

My setup is currently using polling.

According to the logs here the commit SHAs are identical, although on GitHub there's a newer version pushed already. Additionally, checkout is skipped here.

I downgraded to v0.63.0 and everything works as I was expecting.

Steps to reproduce the issue

1. Use latest release 0.67.0
2. Push changes to repo
3. Wait for polling interval
4. See in the logs "skipping checkout, already at correct reference" and "comparing commits" with the same old commit sha, although a newer commit was pushed.

Operating System

Linux

Docker Compose File

name: doco-cd

services:
  app:
    image: ghcr.io/kimdre/doco-cd:0.67.0 # updates are not recognized
    #image: ghcr.io/kimdre/doco-cd:0.63.0 # updates are successfully recognized
    restart: unless-stopped
    depends_on:
      - docker-socket-proxy
    ports:
      - "80:80"       # Webhook endpoint
      - "9120:9120"   # Prometheus metrics
    # For all available settings, see https://github.com/kimdre/doco-cd/wiki/App-Settings
    environment:
      - LOG_LEVEL=debug
      - DOCKER_QUIET_DEPLOY=false
      - DOCKER_SWARM_FEATURES=false
      - GIT_ACCESS_TOKEN_FILE=/run/secrets/git_access_token
      - WEBHOOK_SECRET_FILE=/run/secrets/webhook_secret
      - SOPS_AGE_KEY_FILE=/run/secrets/sops_age_key
      - POLL_CONFIG_FILE=/poll.yml
      - DOCKER_HOST=tcp://docker-socket-proxy:2375
    env_file:
      - ../global.env
    secrets:
      - git_access_token
      - webhook_secret
      - sops_age_key
    volumes:
      - ${VOLUMES_BASE_DIR:-/opt/homelab}/doco-cd/data:/data
    configs:
      - source: poll.yml
        target: /poll.yml
    networks:
      - internal
    healthcheck:
      test: ["CMD", "/doco-cd", "healthcheck"]
      start_period: 15s
      interval: 30s
      timeout: 5s
      retries: 3

  docker-socket-proxy:
    image: ghcr.io/tecnativa/docker-socket-proxy:latest
    restart: unless-stopped
    environment:
      - LOG_LEVEL=notice

      - POST=1

      - VERSION=1
      - INFO=1
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - VOLUMES=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - internal
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: wget --spider http://localhost:2375/version || exit 1
      interval: 60s
      retries: 3
      start_period: 5s
      timeout: 5s

secrets:
  git_access_token:
    file: git_access_token.secret.txt
  webhook_secret:
    file: webhook.secret.txt
  sops_age_key:
    file: sops_age_key.secret.txt

configs:
  poll.yml:
    file: poll.yml

networks:
  internal:
    driver: bridge

Deployment Config

name: homelab
reference: refs/heads/main
working_dir: apps/
env_files:
  # ./global.env
  - ../../global.env
auto_discover: true
auto_discover_opts:
  depth: 1
  delete: true

Logs

[jahredhope]

I think my issue is related, and it might have something to do with how UpdateRepository checks out the code.

Current Behaviour / Behaviour in (ghcr.io/kimdre/doco-cd:latest)

When receiving a web hook for an existing repository:

1. doco-cd correctly identifies the new reference and fetches it.
2. doco-cd appears to checkout the new content, however the content (/data/*) still appears to be the initially cloned content

Expected Behaviour / Actual behaviour in (ghcr.io/kimdre/doco-cd:0.63.0)

When receiving a web hook for an existing repository:

1. doco-cd correctly identifies the new reference and fetches it.
2. doco-cd appears to checkout the new content, the content (/data/*) shows the latest content of the referenced git ref

Workaround

Rollback to version v0.63.0

services:
  doco-cd:
    image: ghcr.io/kimdre/doco-cd:0.63.0

Potential Cause (Just guessing)

In doco-cd’s internal/git/git.go, UpdateRepository does:

1. Fetch from the remote → only refs/remotes/origin/* (e.g. refs/remotes/origin/main) are updated.
2. Checkout(ref) → GetReferenceSet prefers the local ref (e.g. refs/heads/main) and returns that.
3. So it checks out the local branch. In go-git, Fetch does not update refs/heads/main, only refs/remotes/origin/main. So the working tree stays on the old commit.

So on every webhook (and poll), doco-cd fetches new commits but then checks out the existing local branch, which was never updated. The job runs, but the content in the volume stays old.

[kimdre]

Thanks for the hint :) I'm working on a fix.

[kimdre]

Can you please test v0.67.1?

[jahredhope]

Works for me.

I'm not the OP but I've just tested my scenario. And can confirm:

0.67.0 - Doesn't update on webhook event
0.67.1 - Does update on webhook event

Thanks for the really quick turn around on this, and thanks for the project it's been really great.

[jrehwaldt]

I can also confirm it is working now. Thank you for this nice tool and the extremely swift fix ❤️