Description
For GitHub App deployments, watch-path filtering currently unions the added, removed, and modified arrays from every commit in a push. In a multi-commit push containing merge commits, an intermediate commit can report a path relative to its first parent even when that path is unchanged between the push event's before and after SHAs.
This can trigger deployments for applications whose watched files did not change in the final branch update.
Steps to reproduce
- Configure two applications from one repository:
- app A watches
packages/payments/**
- app B watches
apps/dashboard/**
- Create a feature branch from an older base.
- Merge the integration branch into the feature branch so the merge commit reports
packages/payments/config.yml relative to its first parent.
- Merge or push the integration branch to the deployment branch after that file is already present there.
- Confirm
git diff <before>..<after> -- packages/payments is empty.
- Observe that app A still deploys because the webhook's per-commit file union contains the transient path.
Expected behavior
Watch paths should be evaluated against the net files changed between the push payload's before and after SHAs.
Actual behavior
Any path mentioned by any commit in the pushed history can trigger a deployment, including paths that are unchanged in the final branch state.
Root cause
The GitHub push webhook handler builds its changed-file list from commits.*.added, commits.*.removed, and commits.*.modified. Coolify already has a GitHub Compare helper for before...after, used by pull-request synchronization, which provides the correct net file set.
Version
4.1.2 and current next
Additional information
A safe implementation can use the Compare API as the authoritative source when available and retain the webhook arrays as a fallback for branch creation, branch deletion, or API failure.
Description
For GitHub App deployments, watch-path filtering currently unions the
added,removed, andmodifiedarrays from every commit in a push. In a multi-commit push containing merge commits, an intermediate commit can report a path relative to its first parent even when that path is unchanged between the push event'sbeforeandafterSHAs.This can trigger deployments for applications whose watched files did not change in the final branch update.
Steps to reproduce
packages/payments/**apps/dashboard/**packages/payments/config.ymlrelative to its first parent.git diff <before>..<after> -- packages/paymentsis empty.Expected behavior
Watch paths should be evaluated against the net files changed between the push payload's
beforeandafterSHAs.Actual behavior
Any path mentioned by any commit in the pushed history can trigger a deployment, including paths that are unchanged in the final branch state.
Root cause
The GitHub push webhook handler builds its changed-file list from
commits.*.added,commits.*.removed, andcommits.*.modified. Coolify already has a GitHub Compare helper forbefore...after, used by pull-request synchronization, which provides the correct net file set.Version
4.1.2 and current
nextAdditional information
A safe implementation can use the Compare API as the authoritative source when available and retain the webhook arrays as a fallback for branch creation, branch deletion, or API failure.