fix: restrict pulling to specific branch

See coop-cloud/organising#397

cli/internal/deploy.go

@@ -8,6 +8,7 @@ import (
 	"path"
 	"strings"
 
+	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/dns"
 	"coopcloud.tech/abra/pkg/formatter"
@@ -16,15 +17,19 @@ import (
 	"coopcloud.tech/abra/pkg/recipe"
 	"coopcloud.tech/abra/pkg/upstream/stack"
 	"github.com/AlecAivazis/survey/v2"
-	dockerClient "github.com/docker/docker/client"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 )
 
 // DeployAction is the main command-line action for this package
-func DeployAction(c *cli.Context, cl *dockerClient.Client) error {
+func DeployAction(c *cli.Context) error {
 	app := ValidateApp(c)
 
+	cl, err := client.New(app.Server)
+	if err != nil {
+		logrus.Fatal(err)
+	}
+
 	if !Chaos {
 		if err := recipe.EnsureUpToDate(app.Recipe); err != nil {
 			logrus.Fatal(err)

pkg/recipe/recipe.go

@@ -24,6 +24,7 @@ import (
 	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/distribution/reference"
 	"github.com/go-git/go-git/v5"
+	gitConfig "github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/sirupsen/logrus"
 )
@@ -583,7 +584,7 @@ func EnsureUpToDate(recipeName string) error {
 
 	isClean, err := gitPkg.IsClean(recipeDir)
 	if err != nil {
-		return err
+		return fmt.Errorf("unable to check git clean status in %s: %s", recipeDir, err)
 	}
 
 	if !isClean {
@@ -593,12 +594,12 @@ func EnsureUpToDate(recipeName string) error {
 
 	repo, err := git.PlainOpen(recipeDir)
 	if err != nil {
-		return err
+		return fmt.Errorf("unable to open %s: %s", recipeDir, err)
 	}
 
 	remotes, err := repo.Remotes()
 	if err != nil {
-		return err
+		return fmt.Errorf("unable to read remotes in %s: %s", recipeDir, err)
 	}
 
 	if len(remotes) == 0 {
@@ -608,27 +609,35 @@ func EnsureUpToDate(recipeName string) error {
 
 	worktree, err := repo.Worktree()
 	if err != nil {
-		return err
+		return fmt.Errorf("unable to open git work tree in %s: %s", recipeDir, err)
 	}
 
 	branch, err := gitPkg.CheckoutDefaultBranch(repo, recipeDir)
 	if err != nil {
-		return err
+		return fmt.Errorf("unable to check out default branch in %s: %s", recipeDir, err)
 	}
 
 	fetchOpts := &git.FetchOptions{
 		Tags: git.AllTags,
+		RefSpecs: []gitConfig.RefSpec{
+			gitConfig.RefSpec(fmt.Sprintf("%s:%s", branch, branch)),
+		},
+	}
+	if err := repo.Fetch(fetchOpts); err != nil {
+		if !strings.Contains(err.Error(), "already up-to-date") {
+			return fmt.Errorf("unable to fetch tags in %s: %s", recipeDir, err)
+		}
 	}
-	repo.Fetch(fetchOpts)
 
 	opts := &git.PullOptions{
 		Force:         true,
 		ReferenceName: branch,
+		SingleBranch:  true,
 	}
 
 	if err := worktree.Pull(opts); err != nil {
 		if !strings.Contains(err.Error(), "already up-to-date") {
-			return err
+			return fmt.Errorf("unable to git pull in %s: %s", recipeDir, err)
 		}
 	}
 
@@ -1053,15 +1062,6 @@ func UpdateRepositories(repos RepoCatalogue, recipeName string) error {
 				logrus.Fatal(err)
 			}
 
-			isClean, err := gitPkg.IsClean(recipeDir)
-			if err != nil {
-				logrus.Fatal(err)
-			}
-
-			if !isClean {
-				logrus.Fatalf("%s has locally unstaged changes", rm.Name)
-			}
-
 			if err := EnsureUpToDate(rm.Name); err != nil {
 				logrus.Fatal(err)
 			}

pkg/ssh/ssh.go

@@ -75,6 +75,8 @@ func Fatal(hostname string, err error) error {
 		return fmt.Errorf("could not resolve hostname for %s", hostname)
 	} else if strings.Contains(out, "Connection timed out") {
 		return fmt.Errorf("connection timed out for %s", hostname)
+	} else if strings.Contains(out, "Permission denied") {
+		return fmt.Errorf("ssh auth: permission denied for %s", hostname)
 	} else {
 		return err
 	}