Add --force-push flag in rill deploy to force push changes for rill managed repos

cli/cmd/deploy/deploy.go

@@ -72,7 +72,6 @@ func DeployCmd(ch *cmdutil.Helper) *cobra.Command {
 	deployCmd.Flags().StringVar(&opts.PrimaryBranch, "primary-branch", "", "Git branch to deploy from (default: the default Git branch)")
 	deployCmd.Flags().IntVar(&opts.Slots, "prod-slots", local.DefaultProdSlots(ch), "Slots to allocate for production deployments")
 	deployCmd.Flags().IntVar(&opts.DevSlots, "dev-slots", local.DefaultDevSlots(ch), "Slots to allocate for dev deployments")
-	deployCmd.Flags().BoolVar(&opts.PushEnv, "push-env", true, "Push local .env file to Rill Cloud")
 	if !ch.IsDev() {
 		if err := deployCmd.Flags().MarkHidden("prod-slots"); err != nil {
 			panic(err)
@@ -81,7 +80,8 @@ func DeployCmd(ch *cmdutil.Helper) *cobra.Command {
 			panic(err)
 		}
 	}
-
+	deployCmd.Flags().BoolVar(&opts.PushEnv, "push-env", true, "Push local .env file to Rill Cloud")
+	deployCmd.Flags().BoolVar(&opts.ForcePush, "force-push", false, "Force push local changes in case of Rill managed repos")
 	deployCmd.Flags().BoolVar(&opts.Managed, "managed", false, "Create project using rill managed repo")
 	deployCmd.Flags().BoolVar(&opts.ArchiveUpload, "archive", false, "Create project using tarballs(for testing only)")
 	err := deployCmd.Flags().MarkHidden("archive")
@@ -92,7 +92,7 @@ func DeployCmd(ch *cmdutil.Helper) *cobra.Command {
 	// subpath cannot be used with archive or managed deploys
 	deployCmd.MarkFlagsMutuallyExclusive("managed", "archive", "subpath")
 	deployCmd.MarkFlagsMutuallyExclusive("managed", "archive", "github")
-
+	deployCmd.MarkFlagsMutuallyExclusive("force-push", "github")
 	deployCmd.Flags().BoolVar(&opts.SkipDeploy, "skip-deploy", false, "Skip the runtime deployment step (for testing only)")
 	if !ch.IsDev() {
 		err = deployCmd.Flags().MarkHidden("skip-deploy")

cli/cmd/project/deploy.go

@@ -38,6 +38,7 @@ type DeployOpts struct {
 	Slots         int
 	DevSlots      int
 	PushEnv       bool
+	ForcePush     bool
 
 	ArchiveUpload bool
 	// Managed indicates if the project should be deployed using Rill Managed Git.
@@ -90,6 +91,9 @@ func (o *DeployOpts) ValidateAndApplyDefaults(ctx context.Context, ch *cmdutil.H
 			return err
 		}
 		if exists {
+			if p.ManagedGitId == "" && p.ArchiveAssetId == "" && o.ForcePush {
+				return fmt.Errorf("project %q/%q is connected to a GitHub repository. Cannot use --force-push flag", ch.Org, o.Name)
+			}
 			if ch.Interactive {
 				if err := cmdutil.ConfirmPrompt(fmt.Sprintf("Project with name %q already exists. Do you want to push current changes to the existing project?", o.Name), true); err != nil {
 					return err
@@ -128,9 +132,14 @@ func (o *DeployOpts) ValidateAndApplyDefaults(ctx context.Context, ch *cmdutil.H
 
 	// if there is a project already connected to this repo+subpath offer to push changes to it
 	if o.pushToProject != nil {
-		if o.pushToProject.ManagedGitId == "" && o.Managed {
-			ch.PrintfError("Project %s/%s is already connected to this GitHub repository. Cannot use --managed flag.\n", o.pushToProject.OrgName, o.pushToProject.Name)
-			return fmt.Errorf("aborting deploy")
+		if o.pushToProject.ManagedGitId == "" {
+			if o.Managed {
+				ch.PrintfError("Project %s/%s is already connected to this GitHub repository. Cannot use --managed flag.\n", o.pushToProject.OrgName, o.pushToProject.Name)
+				return fmt.Errorf("aborting deploy")
+			}
+			if o.ForcePush {
+				return fmt.Errorf("project %s/%s is connected to a GitHub repository. Cannot use --force-push flag", o.pushToProject.OrgName, o.pushToProject.Name)
+			}
 		}
 		if o.pushToProject.ManagedGitId != "" && o.Github {
 			ch.Printf("Found another rill managed project %s/%s connected to this folder\n", o.pushToProject.OrgName, o.pushToProject.Name)
@@ -288,7 +297,6 @@ func DeployCmd(ch *cmdutil.Helper) *cobra.Command {
 	deployCmd.Flags().StringVar(&opts.PrimaryBranch, "primary-branch", "", "Git branch to deploy from (default: the default Git branch)")
 	deployCmd.Flags().IntVar(&opts.Slots, "prod-slots", local.DefaultProdSlots(ch), "Slots to allocate for production deployments")
 	deployCmd.Flags().IntVar(&opts.DevSlots, "dev-slots", local.DefaultDevSlots(ch), "Slots to allocate for dev deployments")
-	deployCmd.Flags().BoolVar(&opts.PushEnv, "push-env", true, "Push local .env file to Rill Cloud")
 	if !ch.IsDev() {
 		if err := deployCmd.Flags().MarkHidden("prod-slots"); err != nil {
 			panic(err)
@@ -298,6 +306,8 @@ func DeployCmd(ch *cmdutil.Helper) *cobra.Command {
 		}
 	}
 
+	deployCmd.Flags().BoolVar(&opts.PushEnv, "push-env", true, "Push local .env file to Rill Cloud")
+	deployCmd.Flags().BoolVar(&opts.ForcePush, "force-push", false, "Force push local changes")
 	deployCmd.Flags().BoolVar(&opts.SkipDeploy, "skip-deploy", false, "Skip the runtime deployment step (for testing only)")
 	if !ch.IsDev() {
 		err := deployCmd.Flags().MarkHidden("skip-deploy")
@@ -464,7 +474,7 @@ func redeployProject(ctx context.Context, ch *cmdutil.Helper, opts *DeployOpts)
 	}
 	proj := opts.pushToProject
 	if proj.ManagedGitId != "" {
-		err := ch.GitHelper(ch.Org, proj.Name, opts.LocalProjectPath()).PushToManagedRepo(ctx)
+		err := ch.GitHelper(ch.Org, proj.Name, opts.LocalProjectPath()).PushToManagedRepo(ctx, opts.ForcePush)
 		if err != nil {
 			return err
 		}

cli/pkg/cmdutil/githelper.go

@@ -117,7 +117,7 @@ func (g *GitHelper) PushToNewManagedRepo(ctx context.Context, primaryBranch stri
 	return gitRepo, nil
 }
 
-func (g *GitHelper) PushToManagedRepo(ctx context.Context) error {
+func (g *GitHelper) PushToManagedRepo(ctx context.Context, forcePush bool) error {
 	gitConfig, err := g.GitConfig(ctx)
 	if err != nil {
 		return err
@@ -127,6 +127,9 @@ func (g *GitHelper) PushToManagedRepo(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
+	if forcePush {
+		return gitutil.CommitAndForcePush(ctx, g.localPath, gitConfig, "", author)
+	}
 	err = g.h.CommitAndSafePush(ctx, g.localPath, gitConfig, "", author, "1")
 	if err != nil {
 		return err

cli/pkg/local/server.go

@@ -517,7 +517,7 @@ func (s *Server) RedeployProject(ctx context.Context, r *connect.Request[localv1
 	} else if r.Msg.Reupload {
 		if projResp.Project.ManagedGitId != "" {
 			// If rill-managed project then push to the repo based on org/project passed in.
-			err = s.app.ch.GitHelper(projResp.Project.OrgName, projResp.Project.Name, s.app.ProjectPath).PushToManagedRepo(ctx)
+			err = s.app.ch.GitHelper(projResp.Project.OrgName, projResp.Project.Name, s.app.ProjectPath).PushToManagedRepo(ctx, false)
 			if err != nil {
 				return nil, err
 			}

docs/docs/reference/cli/deploy.md

@@ -23,6 +23,7 @@ rill deploy [<path>] [flags]
       --provisioner string      Project provisioner
       --primary-branch string   Git branch to deploy from (default: the default Git branch)
       --push-env                Push local .env file to Rill Cloud (default true)
+      --force-push              Force push local changes in case of Rill managed repos
       --managed                 Create project using rill managed repo
       --github                  Use github repo to create the project
 ```

docs/docs/reference/cli/project/deploy.md

@@ -22,6 +22,7 @@ rill project deploy [<path>] [flags]
       --provisioner string      Project provisioner
       --primary-branch string   Git branch to deploy from (default: the default Git branch)
       --push-env                Push local .env file to Rill Cloud (default true)
+      --force-push              Force push local changes
 ```
 
 ### Global flags

runtime/pkg/gitutil/commit.go

@@ -166,6 +166,43 @@ func CommitAndPush(ctx context.Context, path string, config *Config, commitMsg s
 	return Push(ctx, path, remote, config.DefaultBranch)
 }
 
+// CommitAndForcePush is similar to CommitAndPush but force pushes the local changes to the remote.
+// Unlike CommitAndPush, the current local branch need not match config.DefaultBranch, and HEAD may
+// be detached.
+func CommitAndForcePush(ctx context.Context, path string, config *Config, commitMsg string, author Signature) error {
+	if config.Subpath != "" {
+		// this is ensured upstream but just to be safe
+		return fmt.Errorf("force push does not support subpath, please commit and push from the root of the repository")
+	}
+	err := EnsureInit(ctx, path, config.DefaultBranch)
+	if err != nil {
+		return fmt.Errorf("failed to init git repo: %w", err)
+	}
+
+	if commitMsg == "" {
+		commitMsg = "Auto committed by Rill"
+	}
+	_, err = CommitAll(ctx, path, "", commitMsg, author)
+	if err != nil && !errors.Is(err, ErrEmptyCommit) {
+		return fmt.Errorf("failed to commit files to git: %w", err)
+	}
+
+	err = SetRemote(path, config)
+	if err != nil {
+		return err
+	}
+
+	if config.Username == "" {
+		return ForcePush(ctx, path, config.RemoteName(), config.DefaultBranch)
+	}
+
+	remote, err := config.FullyQualifiedRemote()
+	if err != nil {
+		return err
+	}
+	return ForcePush(ctx, path, remote, config.DefaultBranch)
+}
+
 // IsCommitHash reports whether s is a full hex commit hash (SHA-1 or SHA-256).
 // Use it to validate untrusted hashes before passing them as git CLI arguments: it rules out
 // strings that git would interpret as flags or other revision syntax.

runtime/pkg/gitutil/commit_test.go

@@ -9,6 +9,101 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestCommitAndForcePush(t *testing.T) {
+	ctx := context.Background()
+	author := Signature{Name: "Rill", Email: "noreply@rilldata.com"}
+
+	t.Run("succeeds on matching branch with uncommitted changes", func(t *testing.T) {
+		local, remote := setupRepoWithRemote(t)
+		branch := getCurrentBranch(t, local)
+
+		require.NoError(t, os.WriteFile(filepath.Join(local, "new.txt"), []byte("hello"), 0644))
+
+		config := &Config{Remote: remote, DefaultBranch: branch}
+		require.NoError(t, CommitAndForcePush(ctx, local, config, "force push commit", author))
+
+		localTip, err := Hash(ctx, local, "HEAD")
+		require.NoError(t, err)
+		remoteTip, err := Hash(ctx, remote, "refs/heads/"+branch)
+		require.NoError(t, err)
+		require.Equal(t, localTip, remoteTip)
+	})
+
+	t.Run("pushes even when there is nothing to commit", func(t *testing.T) {
+		local, remote := setupRepoWithRemote(t)
+		branch := getCurrentBranch(t, local)
+
+		// create a local-only commit with nothing left in the working tree
+		createCommit(t, local, "unpushed.txt", "content", "local-only commit")
+		localTip, err := Hash(ctx, local, "HEAD")
+		require.NoError(t, err)
+
+		config := &Config{Remote: remote, DefaultBranch: branch}
+		require.NoError(t, CommitAndForcePush(ctx, local, config, "", author))
+
+		remoteTip, err := Hash(ctx, remote, "refs/heads/"+branch)
+		require.NoError(t, err)
+		require.Equal(t, localTip, remoteTip, "local-only commit must reach the remote")
+	})
+
+	t.Run("succeeds from a detached HEAD", func(t *testing.T) {
+		local, remote := setupRepoWithRemote(t)
+		branch := getCurrentBranch(t, local)
+
+		require.NoError(t, execGit(local, "checkout", "--detach"))
+		require.NoError(t, os.WriteFile(filepath.Join(local, "detached.txt"), []byte("from detached HEAD"), 0644))
+
+		config := &Config{Remote: remote, DefaultBranch: branch}
+		require.NoError(t, CommitAndForcePush(ctx, local, config, "detached commit", author))
+
+		localTip, err := Hash(ctx, local, "HEAD")
+		require.NoError(t, err)
+		remoteTip, err := Hash(ctx, remote, "refs/heads/"+branch)
+		require.NoError(t, err)
+		require.Equal(t, localTip, remoteTip, "force push from detached HEAD must update the remote branch")
+	})
+
+	t.Run("succeeds from a different local branch", func(t *testing.T) {
+		local, remote := setupRepoWithRemote(t)
+		defaultBranch := getCurrentBranch(t, local)
+
+		require.NoError(t, execGit(local, "checkout", "-b", "feature"))
+		require.NoError(t, os.WriteFile(filepath.Join(local, "feature.txt"), []byte("feature work"), 0644))
+
+		config := &Config{Remote: remote, DefaultBranch: defaultBranch}
+		require.NoError(t, CommitAndForcePush(ctx, local, config, "feature commit", author))
+
+		localTip, err := Hash(ctx, local, "HEAD")
+		require.NoError(t, err)
+		remoteTip, err := Hash(ctx, remote, "refs/heads/"+defaultBranch)
+		require.NoError(t, err)
+		require.Equal(t, localTip, remoteTip, "remote default branch must be overwritten with the local feature branch tip")
+	})
+
+	t.Run("overwrites divergent remote history", func(t *testing.T) {
+		local, remote := setupRepoWithRemote(t)
+		branch := getCurrentBranch(t, local)
+
+		// advance the remote with a commit that local doesn't have
+		createRemoteCommit(t, remote, "remote-only.txt", "remote content", "remote-only commit")
+
+		// advance local with a different commit, creating a true divergence from the initial tip
+		createCommit(t, local, "local-only.txt", "local content", "local-only commit")
+
+		// add uncommitted changes so CommitAll also has work to do
+		require.NoError(t, os.WriteFile(filepath.Join(local, "extra.txt"), []byte("extra"), 0644))
+
+		config := &Config{Remote: remote, DefaultBranch: branch}
+		require.NoError(t, CommitAndForcePush(ctx, local, config, "force over divergence", author))
+
+		localTip, err := Hash(ctx, local, "HEAD")
+		require.NoError(t, err)
+		remoteTip, err := Hash(ctx, remote, "refs/heads/"+branch)
+		require.NoError(t, err)
+		require.Equal(t, localTip, remoteTip, "force push must overwrite the divergent remote history")
+	})
+}
+
 func TestCurrentBranch(t *testing.T) {
 	ctx := context.Background()
 

runtime/pkg/gitutil/sync.go

@@ -174,6 +174,14 @@ func Push(ctx context.Context, path, remote, refspec string) error {
 	return err
 }
 
+// ForcePush force-pushes HEAD to branch on remote, overwriting the remote ref unconditionally.
+// It uses the refspec HEAD:<branch> so it works even when the local HEAD is detached or points
+// to a different branch. remote may be a remote name or a URL with embedded credentials.
+func ForcePush(ctx context.Context, path, remote, branch string) error {
+	_, err := Run(ctx, path, "push", "--force", remote, "HEAD:"+branch)
+	return err
+}
+
 // UpstreamMerge merges the remote tracking branch `<remoteName>/<branch>` into the current branch.
 // If favourLocal is true, merge conflicts are resolved in favour of local changes.
 func UpstreamMerge(ctx context.Context, path, remoteName, branch string, favourLocal bool) error {