From 849bb065c696982d5b8be3f9f189b77458995769 Mon Sep 17 00:00:00 2001
From: Alexandru Macocian <amacocian@yahoo.com>
Date: Tue, 5 May 2026 21:22:20 +0200
Subject: [PATCH] Cleanup old .env on deploy

---
 .gitea/workflows/deploy-stack.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.gitea/workflows/deploy-stack.yml b/.gitea/workflows/deploy-stack.yml
index d1b2fd6..b9eac75 100644
--- a/.gitea/workflows/deploy-stack.yml
+++ b/.gitea/workflows/deploy-stack.yml
@@ -164,6 +164,13 @@ jobs:
               esac
               dst_dir="$(dirname -- "$dst")"
               [ "$dst_dir" = "." ] || mkdir -p "$dst_dir"
+              # Pre-clear any leftover destination. Catches the case where
+              # a stack's first SOPS deploy lands on a host whose old
+              # hand-edited plaintext .env is still root-owned (the runner
+              # can't overwrite it, but it can unlink it because it owns
+              # the stack dir). On a non-empty repo where the runner is
+              # the legitimate writer of $dst, this is a no-op.
+              rm -f -- "$dst"
               umask 077
               sops --decrypt --output-type "$out_format" --output "$dst" "$src"
               chmod 600 "$dst"