Fix git deploy permissions: entrypoint chown and no remote set-url

Co-authored-by: Cursor <cursoragent@cursor.com>

app/deploy_utils.py

@@ -38,38 +38,77 @@ def run_git(args, timeout=120):
     return True, result.stdout.strip()
 
 
+def run_ls_remote(extra_args=None, timeout=60):
+    remote = get_git_remote()
+    if not remote:
+        return False, "GIT_REMOTE_URL не задан", []
+
+    cmd = ["git", "ls-remote", remote]
+    if extra_args:
+        cmd.extend(extra_args)
+
+    result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+    if result.returncode != 0:
+        return False, (result.stderr or result.stdout or "ls-remote error").strip(), []
+    return True, "", result.stdout.splitlines()
+
+
 def fetch_remote():
     remote = get_git_remote()
-    if remote:
-        ok, msg = run_git(["remote", "set-url", "origin", remote])
-        if not ok:
-            return False, msg
-    return run_git(["fetch", "--all", "--tags", "--prune"], timeout=180)
+    if not remote:
+        return run_git(["fetch", "--all", "--tags", "--prune"], timeout=180)
+
+    # Fetch from URL directly — do not write remote.origin.url to .git/config
+    return run_git(
+        [
+            "fetch",
+            "--tags",
+            "--prune",
+            remote,
+            "+refs/heads/*:refs/remotes/origin/*",
+            "+refs/tags/*:refs/tags/*",
+        ],
+        timeout=180,
+    )
 
 
 def list_tags():
-    ok, msg = fetch_remote()
+    ok, err, lines = run_ls_remote(["--tags"])
     if not ok:
-        return [], msg
-    ok, out = run_git(["tag", "--sort=-version:refname"])
-    if not ok:
-        return [], out
-    return [line for line in out.splitlines() if line.strip()], None
+        return [], err
+
+    tags = []
+    for line in lines:
+        parts = line.split()
+        if len(parts) < 2:
+            continue
+        ref = parts[1]
+        if not ref.startswith("refs/tags/"):
+            continue
+        tag = ref.removeprefix("refs/tags/")
+        if tag.endswith("^{}"):
+            continue
+        tags.append(tag)
+
+    tags = sorted(set(tags), reverse=True)
+    return tags, None
 
 
 def list_branches():
-    ok, msg = fetch_remote()
+    ok, err, lines = run_ls_remote(["--heads"])
     if not ok:
-        return [], msg
-    ok, out = run_git(["branch", "-a", "--format=%(refname:short)"])
-    if not ok:
-        return [], out
+        return [], err
+
     branches = []
-    for line in out.splitlines():
-        name = line.strip().replace("origin/", "")
-        if name and name not in branches and "HEAD" not in name:
-            branches.append(name)
-    return branches, None
+    for line in lines:
+        parts = line.split()
+        if len(parts) < 2:
+            continue
+        ref = parts[1]
+        if ref.startswith("refs/heads/"):
+            branches.append(ref.removeprefix("refs/heads/"))
+
+    return sorted(set(branches)), None
 
 
 def get_current_version():