Cleanup old .env on deploy

2026-05-05 21:22:20 +02:00
parent d91e18ddfb
commit 849bb065c6
1 changed files with 7 additions and 0 deletions
@@ -164,6 +164,13 @@ jobs:
              esac
              dst_dir="$(dirname -- "$dst")"
              [ "$dst_dir" = "." ] || mkdir -p "$dst_dir"
+              # Pre-clear any leftover destination. Catches the case where
+              # a stack's first SOPS deploy lands on a host whose old
+              # hand-edited plaintext .env is still root-owned (the runner
+              # can't overwrite it, but it can unlink it because it owns
+              # the stack dir). On a non-empty repo where the runner is
+              # the legitimate writer of $dst, this is a no-op.
+              rm -f -- "$dst"
              umask 077
              sops --decrypt --output-type "$out_format" --output "$dst" "$src"
              chmod 600 "$dst"