From cc1d1d3fb388afef86c4a763d4f0bd2f63a1b9b3 Mon Sep 17 00:00:00 2001
From: Jesse_Chen <chen.yue@mevixaga.com>
Date: Fri, 14 Aug 2026 02:11:07 +0800
Subject: [PATCH] fix(deploy): fall back to container SHA discovery when the
 staging revision state file is unreadable

The staging host currently has .state/deployed-revision unreadable by the
deploy user, so the forward-only revision check failed with 'Permission
denied' before it could compare revisions. Treat an unreadable state file
like a missing one and discover the running revision from the web
container's GITHUB_SHA, in both the workflow step and the server-side
deploy/migration scripts.
---
 .github/workflows/deploy-staging.yml | 2 +-
 deploy/run-staging-deploy.sh         | 2 +-
 deploy/run-staging-migration.sh      | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 3255f1e4..c5c72c42 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -176,7 +176,7 @@ jobs:
           set -euo pipefail
           SSH_OPTIONS="-i $HOME/.ssh/jyotisha-staging -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
           previous_sha="$(ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" \
-            "state='$DEPLOY_PATH/.state/deployed-revision'; if [ -f \"\$state\" ]; then cat \"\$state\"; else id=\$(docker ps -aq --filter 'label=com.docker.compose.project=jyotisha-staging' --filter 'label=com.docker.compose.service=web' | head -n 1); if [ -n \"\$id\" ]; then value=\$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' \"\$id\" | sed -n 's/^GITHUB_SHA=//p' | head -n 1); printf '%s' \"\${value:-not-deployed}\"; else printf not-deployed; fi; fi")"
+            "state='$DEPLOY_PATH/.state/deployed-revision'; if [ -r \"\$state\" ]; then cat \"\$state\"; else id=\$(docker ps -aq --filter 'label=com.docker.compose.project=jyotisha-staging' --filter 'label=com.docker.compose.service=web' | head -n 1); if [ -n \"\$id\" ]; then value=\$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' \"\$id\" | sed -n 's/^GITHUB_SHA=//p' | head -n 1); printf '%s' \"\${value:-not-deployed}\"; else printf not-deployed; fi; fi")"
           if [ "$previous_sha" != "not-deployed" ] && [[ ! "$previous_sha" =~ ^[0-9a-f]{40}$ ]]; then
             echo "invalid deployed staging revision state" >&2
             exit 1
diff --git a/deploy/run-staging-deploy.sh b/deploy/run-staging-deploy.sh
index 4fd18af4..4bffa70a 100755
--- a/deploy/run-staging-deploy.sh
+++ b/deploy/run-staging-deploy.sh
@@ -47,7 +47,7 @@ flock -n 9 || {
 }
 
 current_sha="not-deployed"
-if [ -f "$state_directory/deployed-revision" ]; then
+if [ -r "$state_directory/deployed-revision" ]; then
   current_sha="$(<"$state_directory/deployed-revision")"
 else
   existing_web="$("${docker_command[@]}" ps -aq \
diff --git a/deploy/run-staging-migration.sh b/deploy/run-staging-migration.sh
index 743e30a8..8c9d9468 100755
--- a/deploy/run-staging-migration.sh
+++ b/deploy/run-staging-migration.sh
@@ -41,7 +41,7 @@ flock -n 9 || {
 }
 
 current_sha="not-deployed"
-if [ -f "$state_directory/deployed-revision" ]; then
+if [ -r "$state_directory/deployed-revision" ]; then
   current_sha="$(<"$state_directory/deployed-revision")"
 else
   existing_web="$("${docker_command[@]}" ps -aq \