Problem
create-harper scaffolds a per-project scripts/deploy.mjs to deploy by git reference; that logic is client-side (it reads the local git repo), so it belongs in the harper CLI — then no scaffolded project needs to carry a script.
Proposal
Opt-in flag on harper deploy / deploy_component. When package= is absent and by_ref=true (or ref=<committish>) is passed, the CLI:
- resolves
owner/repo from GITHUB_REPOSITORY or the origin remote,
- resolves the committish from
ref=, else GITHUB_SHA, else git rev-parse HEAD,
- warns if the working tree is dirty,
- defaults
project from package.json,
- sets
package=git+https://github.com/<owner>/<repo>.git#<sha>.
Pinning by SHA (not tag) avoids cluster peers diverging on a moved tag. git+https, not ssh — a private clone is authenticated by a git-host token credential (#1799), which rides over HTTPS.
For a private repo, credential=github.com (or credential=true) attaches a credentials reference [{ host, secret: "deploy.<component>.<host>" }] — the durable token sealed once by harper deploy setup=true (#1778) — which the cluster resolves in-memory to authenticate the clone. A public repo needs no credential.
The no-flag default stays the payload deploy (backward-compatible). by_ref/ref/credential are transport-only (consumed client-side); credentials is a real operation field and is sent.
Prototype
Branch claude/deploy-by-ref-flag — bin/cliOperations.ts, in PREPARE_OPERATION.deploy_component. Parse + oxlint + prettier clean.
Related — deploy-by-reference effort
HarperFast/harper#1849 — two-phase stage/activate + revert_componentHarperFast/harper#1850 — harper deploy by_ref=true (deploy by git reference)HarperFast/harper#1851 — harper deploy setup=true (client-side sealed deploy credential)HarperFast/harper#1876 — CI token auth + harper login --for-ciHarperFast/harper-pro#594 — add_ssh_key generate=true (cluster-side keygen)HarperFast/create-harper#118 — scaffolds this flowHarperFast/documentation#599 — two-phase deploy docsHarperFast/documentation#616 — by-reference / sealed-credential / CI-auth docs
Problem
create-harperscaffolds a per-projectscripts/deploy.mjsto deploy by git reference; that logic is client-side (it reads the local git repo), so it belongs in theharperCLI — then no scaffolded project needs to carry a script.Proposal
Opt-in flag on
harper deploy/deploy_component. Whenpackage=is absent andby_ref=true(orref=<committish>) is passed, the CLI:owner/repofromGITHUB_REPOSITORYor theoriginremote,ref=, elseGITHUB_SHA, elsegit rev-parse HEAD,projectfrompackage.json,package=git+https://github.com/<owner>/<repo>.git#<sha>.Pinning by SHA (not tag) avoids cluster peers diverging on a moved tag. git+https, not ssh — a private clone is authenticated by a git-host token credential (#1799), which rides over HTTPS.
For a private repo,
credential=github.com(orcredential=true) attaches acredentialsreference[{ host, secret: "deploy.<component>.<host>" }]— the durable token sealed once byharper deploy setup=true(#1778) — which the cluster resolves in-memory to authenticate the clone. A public repo needs no credential.The no-flag default stays the payload deploy (backward-compatible).
by_ref/ref/credentialare transport-only (consumed client-side);credentialsis a real operation field and is sent.Prototype
Branch
claude/deploy-by-ref-flag—bin/cliOperations.ts, inPREPARE_OPERATION.deploy_component. Parse + oxlint + prettier clean.Related — deploy-by-reference effort
HarperFast/harper#1849— two-phase stage/activate +revert_componentHarperFast/harper#1850—harper deploy by_ref=true(deploy by git reference)HarperFast/harper#1851—harper deploy setup=true(client-side sealed deploy credential)HarperFast/harper#1876— CI token auth +harper login --for-ciHarperFast/harper-pro#594—add_ssh_key generate=true(cluster-side keygen)HarperFast/create-harper#118— scaffolds this flowHarperFast/documentation#599— two-phase deploy docsHarperFast/documentation#616— by-reference / sealed-credential / CI-auth docs