From 1263c7540c837c88a531cf5af8c5fcd30ddb448b Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Tue, 28 Jul 2026 17:12:39 +1000
Subject: [PATCH] fix(ha/deploy): ensure remote clone is on correct branch
 before building

When create-proxmox-resource.sh clones the repo to pve1, it stays on
whatever branch was checked out. Add a pre-build phase that detects
branch mismatch and switches the remote clone to the current local
branch before building, so the Proxmox node always builds from the
same commits we're deploying.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8
---
 scripts/ha/deploy.sh | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/scripts/ha/deploy.sh b/scripts/ha/deploy.sh
index acdecac..b47c079 100755
--- a/scripts/ha/deploy.sh
+++ b/scripts/ha/deploy.sh
@@ -236,16 +236,32 @@ if ! $SKIP_SYNC_KEYS; then
   done
 fi
 
-# ── Phase 2.5: Fix /nix ownership on Proxmox node if needed ──────────────────
-# pve1 has a pre-existing /nix store owned by a different UID (from a previous
-# installation); wayne has passwordless sudo so we fix it in-place before the
-# build so create-proxmox-resource.sh's codex-setup.sh can proceed.
+# ── Phase 2.5: Prepare Proxmox node for building ─────────────────────────────
 if ! $SKIP_CREATE_VMS && ! $DRY_RUN; then
+  CURRENT_BRANCH="$(git -C "$REPO_ROOT" rev-parse --abbrev-ref HEAD)"
+
+  # Fix /nix ownership if it exists but belongs to a different UID.
+  # pve1's IPA-enrolled wayne (UID 50002) can't write to a store created by
+  # another UID — passwordless sudo corrects it once.
   if pve_check "test -d /nix" &>/dev/null && ! pve_check "test -w /nix" &>/dev/null; then
     logn "/nix exists but not writable by ${SSH_USER} — fixing ownership with sudo (one-time)..."
     ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" "sudo chown -R ${SSH_USER} /nix"
     logn "Done."
   fi
+
+  # Ensure the remote clone is on the correct branch so create-proxmox-resource.sh
+  # builds from the same commits we're deploying.
+  REMOTE_REPO="/home/${SSH_USER}/nixos"
+  if pve_check "test -d ${REMOTE_REPO}/.git" &>/dev/null; then
+    REMOTE_BRANCH=$(ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" \
+      "cd ${REMOTE_REPO} && git rev-parse --abbrev-ref HEAD 2>/dev/null")
+    if [[ "$REMOTE_BRANCH" != "$CURRENT_BRANCH" ]]; then
+      logn "Remote clone is on '${REMOTE_BRANCH}', switching to '${CURRENT_BRANCH}'..."
+      ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" \
+        "cd ${REMOTE_REPO} && git fetch origin && git checkout '${CURRENT_BRANCH}' && git pull --ff-only"
+      logn "Done."
+    fi
+  fi
 fi
 
 # ── Phase 3: Create VMs ───────────────────────────────────────────────────────