From 3aea10530ee05ac02b5dd3e5ea6760e1717067dc Mon Sep 17 00:00:00 2001
From: Vuong Hoang <vh@phasefinal.com>
Date: Wed, 29 Apr 2026 18:41:36 -0700
Subject: [PATCH] playbooks/deploy-task-board: accept SHA refs, not just
 branches
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI passes --var ref=<github.sha> (a full SHA), but the playbook
hardcoded `git reset --hard origin/{{ ref }}` which only works for
branch names — `origin/<sha>` is invalid syntax. Resolve ref via
git rev-parse with `^{commit}` (try origin/<ref> first for branch
names, fall back to bare <ref> for SHAs/tags) so manual runs (ref=main)
and CI runs (ref=<sha>) both work.

Same fix applied to the changed_when comparison so no-op reruns still
report ok instead of changed.
---
 playbooks/deploy-task-board.yaml | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/playbooks/deploy-task-board.yaml b/playbooks/deploy-task-board.yaml
index ea9c624..efd2f84 100644
--- a/playbooks/deploy-task-board.yaml
+++ b/playbooks/deploy-task-board.yaml
@@ -50,11 +50,20 @@ steps:
   - name: Fetch from origin
     shell: cd {{ build_dir }} && git fetch --quiet origin
 
-  - name: Reset working tree to origin/{{ ref }}
-    shell: cd {{ build_dir }} && git reset --hard origin/{{ ref }}
+  - name: Reset working tree to {{ ref }}
+    # Accept either a branch name (resolves via origin/<ref>) or a
+    # full/short SHA (resolves directly). CI passes the triggering
+    # commit SHA via --var ref=${{ github.sha }}; manual runs pass
+    # branch names like main / v0.1.0.
+    shell: |
+      cd {{ build_dir }}
+      if sha=$(git rev-parse --verify --quiet "origin/{{ ref }}^{commit}"); then :;
+      elif sha=$(git rev-parse --verify --quiet "{{ ref }}^{commit}"); then :;
+      else echo "elway: ref not found: {{ ref }}" >&2; exit 1; fi
+      git reset --hard "$sha"
     # Report ok (no-change) when the tree was already at the requested
     # ref — saves a noisy CHANGED status line on no-op reruns.
-    changed_when: '[ "$(cd {{ build_dir }} && git rev-parse HEAD 2>/dev/null)" != "$(cd {{ build_dir }} && git rev-parse origin/{{ ref }} 2>/dev/null)" ]'
+    changed_when: '[ "$(cd {{ build_dir }} && git rev-parse HEAD)" != "$(cd {{ build_dir }} && (git rev-parse --verify --quiet "origin/{{ ref }}^{commit}" || git rev-parse --verify --quiet "{{ ref }}^{commit}"))" ]'
 
   # ── image build ─────────────────────────────────────────────────────
   - name: Build image {{ image_tag }}