deployangel 0.1.14 → 0.1.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff074e43a43cb39394f9c21d99c1c004c55f68ac7c5a54467acc49b4f0ce1753
-  data.tar.gz: 57f860c0f680e70f46f12756f3f638307cb13ec6aa4131e5ebaac0e1cfe16494
+  metadata.gz: 6080cb323e886841312b4bab49edd0962e2c5a4379c3f23d6dc7eb738944104d
+  data.tar.gz: 36c6a15cfa2c70c3c92e58a500537bed8da5a19291af4852d530e857f21181fa
 SHA512:
-  metadata.gz: 10d7c45fac648fedae41d360d845b3f874be6026bd331e77d063eaf65a036b4f0ba616a0c74df6e18ede073df87789fee71ac84910902d8456306c2ccb3bb0af
-  data.tar.gz: b68c68f332fe45d48be53f3d47e0b5c8bd41b012adf9deb6fc654e4ba9489ed20c3b4b790f6a860723f962ea8774b11082f0a1ce4f0c2f74bb9379b55d0937bf
+  metadata.gz: c586644c984d299e424cc0b3042ac5a474c3271de24ca4ee5f0f89103fb574c0253bc362efa7d0b1d8b212b83ef4aa5a2fcfafb2f3c77477282d2a8f52b284e7
+  data.tar.gz: ed91b7685224b5e613d3cc7de6cf28b36096563d5195e7e4b41069dcd691d6bb7ce49369a8f77fc5c519197bfe1984a4b0f9982520c7a6cb71efe094a69b0150

data/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.1.16 (2026-10-08)
+
+- The agent finds the release in a git checkout when nothing earlier names
+  it: the commit `HEAD` names, read from `.git` in the app root or up to 3
+  directories above it (worktrees and submodules included), without running
+  `git` (source `git_head`). It comes after a `REVISION` file and before ECS.
+- When nothing else identifies the release, the agent reports a fingerprint
+  of the app's code as the version (`code:` and 12 hex characters, source
+  `code_fingerprint`): the hash of the file digests it already computes. It's
+  worked out in the reporter thread as soon as it starts, never at boot or
+  in a request, and needs file digests on. A warning suggests setting
+  `DEPLOYANGEL_REVISION`: without a commit, DeployAngel shows which files
+  changed but not the commits and pull requests.
+- `deployangel install docker` adds `ARG GIT_SHA` and
+  `ENV DEPLOYANGEL_REVISION=$GIT_SHA` at the end of the Dockerfile's last
+  stage, before its `CMD`, and says which `--build-arg` to pass. It never
+  edits CI workflows.
+
+## 0.1.15 (2026-10-06)
+
+- Checkpoints report whether they were recorded in an HTTP request or a job
+  (`http` and `job` counts on each checkpoint), so DeployAngel compares a
+  checkpoint recorded in jobs against job traffic rather than requests. A job
+  performed inline during a request counts as a job. Needs a DeployAngel
+  server that reads the new fields; older servers ignore them.
+
 ## 0.1.14 (2026-10-06)
 
 - `deployangel plan` separates what clearance waits on ("Needed to clear")

data/README.md

@@ -36,26 +36,46 @@ The agent must know which release it is running. It finds it in this order:
    didn't come from GitHub
 7. Coolify: `SOURCE_COMMIT`. Dokku: `GIT_REV`
 8. a `REVISION` file in the app root, which Capistrano writes and any build step can
-9. ECS, including Fargate: the container's image, from the metadata endpoint ECS
-   provides (one local request at boot). The image tag is the release when it's a
-   commit or a version like `v1.4.2`; with a moving tag like `latest`, the image
-   digest is
+9. a git checkout, for servers deployed by `git pull`, Fabric, or Ansible: the commit
+   `HEAD` names, read from `.git` in the app root or up to 3 directories above it
+   (worktrees and submodules included). The agent reads the files; it never runs `git`
+10. ECS, including Fargate: the container's image, from the metadata endpoint ECS
+    provides (one local request at boot). The image tag is the release when it's a
+    commit or a version like `v1.4.2`; with a moving tag like `latest`, the image
+    digest is
+11. a fingerprint of the app's code, reported as `code:` and 12 hex characters: the
+    hash of the [file digests](#what-it-sends) the agent already computes, so the
+    same code is the same release. It needs file digests on, and is worked out in
+    the background when the reporter starts, not at boot. Without a commit, the
+    dashboard shows which files changed but not the commits and pull requests, so
+    the agent logs a warning suggesting `DEPLOYANGEL_REVISION`
 
 For other Docker deploys (compose, Swarm, Kubernetes), and on ECS to see each
 release by its commit, bake the commit into the image, since `.dockerignore`
 usually leaves `.git` out:
 
+```bash
+bundle exec deployangel install docker
+```
+
+adds this to the end of the Dockerfile's last stage, before its `CMD` (so the
+layers above it stay cached):
+
 ```dockerfile
 ARG GIT_SHA
 ENV DEPLOYANGEL_REVISION=$GIT_SHA
 ```
 
-and build with `docker build --build-arg GIT_SHA=$(git rev-parse HEAD) .`. On
-DigitalOcean App Platform, set `DEPLOYANGEL_REVISION: ${_self.COMMIT_HASH}` in
-the app spec. On Elastic Beanstalk, see
-[Deploying to Elastic Beanstalk](#deploying-to-elastic-beanstalk). If the agent
-finds none of these, its telemetry can't be tied to a deploy, and the dashboard
-says so.
+Then build with `docker build --build-arg GIT_SHA=$(git rev-parse HEAD) .`
+(`fly deploy --build-arg GIT_SHA=$(git rev-parse HEAD)` on Fly.io, or
+`build-args: GIT_SHA=${{ github.sha }}` with GitHub's docker/build-push-action).
+It changes nothing if the Dockerfile already sets `DEPLOYANGEL_REVISION`, and
+never edits CI workflows. A build without the argument leaves the variable
+empty, which counts as unset. On DigitalOcean App Platform, set
+`DEPLOYANGEL_REVISION: ${_self.COMMIT_HASH}` in the app spec. On Elastic
+Beanstalk, see [Deploying to Elastic Beanstalk](#deploying-to-elastic-beanstalk).
+If the agent finds none of these, its telemetry can't be tied to a deploy, and
+the dashboard says so.
 
 ## What it sends
 
@@ -207,6 +227,10 @@ and job still succeeds. Only drops are flagged, and a checkpoint without enough
 traffic never blocks a release from being cleared. Checkpoints can also be part
 of a critical flow (`checkpoint:order.created`).
 
+The agent also records whether each checkpoint was counted during an HTTP
+request or a background job, so DeployAngel compares it against the right
+traffic: a checkpoint counted in jobs is judged against jobs, not requests.
+
 It's safe to call anywhere: it never raises, never touches the network, and is
 ignored outside reporting environments. Names use letters, numbers, and
 `. _ : -` (up to 100 characters); keep them to a fixed set rather than
@@ -294,6 +318,9 @@ It writes `.kamal/hooks/post-deploy`, which runs `deployangel release` after eac
 to add). Set `DEPLOYANGEL_API_TOKEN` (a CI deploys token) wherever you run
 `kamal deploy`. The hook never fails a deploy.
 
+Kamal apps don't need `deployangel install docker`: `KAMAL_VERSION` already
+identifies the release.
+
 ### Deploying with Capistrano
 
 Capistrano writes a `REVISION` file into each release, so the agent already

data/lib/deployangel/agent.rb

@@ -16,7 +16,7 @@ module DeployAngel
     # later still lands in time.
     FLUSH_JITTER = 1.0..50.0
 
-    attr_reader :config, :release, :instance
+    attr_reader :config, :instance
     attr_writer :metadata
 
     def initialize(config:, environment:, root: nil, framework: nil, framework_version: nil,
@@ -24,6 +24,11 @@ module DeployAngel
       @config = config
       @active = config.active?(environment)
       @release = Release.resolve(config: config, env: env, root: root)
+      # Nothing named the release, so the code fingerprint may. It hashes the
+      # app's files, so the reporter computes it before its first send (see
+      # #release), never at boot or in a request.
+      @fingerprint_pending = @release.unknown?
+      @release_mutex = Mutex.new
       @runtime = Protocol.runtime(framework: framework, framework_version: framework_version)
       @transport = transport || Transport.new(config)
       @env = env
@@ -33,8 +38,6 @@ module DeployAngel
       @thread_mutex = Mutex.new
       @warned = {}
       reset_process_state
-      warn_once(:unknown_release, "DeployAngel could not determine the release; set DEPLOYANGEL_REVISION " \
-        "or enable Heroku dyno metadata. Telemetry will not be attributed to deployments.") if @active && @release.unknown?
       start_reporter if @active && eager
     end
 
@@ -42,6 +45,25 @@ module DeployAngel
       @active
     end
 
+    # The release this process is running. The first call may build the file
+    # digests for the code fingerprint, so only the reporter thread and
+    # shutdown call it; requests and jobs never read the release.
+    def release
+      return @release unless @fingerprint_pending
+
+      @release_mutex.synchronize do
+        if @fingerprint_pending
+          @release = Release.code_fingerprint(@metadata&.file_manifest) || @release
+          @fingerprint_pending = false
+          warn_about_release
+        end
+      end
+      @release
+    rescue StandardError
+      @fingerprint_pending = false
+      @release
+    end
+
     def record_request(route_key:, status:, duration_ms:, unhandled: false, in_totals: true)
       return unless @active
 
@@ -71,12 +93,14 @@ module DeployAngel
       warn_once(:record_discard, "DeployAngel failed to record a discarded job: #{e.class}: #{e.message}")
     end
 
-    def record_checkpoint(name, count: 1)
+    # context defaults to the unit of work this fiber is running: an HTTP
+    # request, a job, or neither.
+    def record_checkpoint(name, count: 1, context: ExecutionContext.current)
       return unless @active
 
       after_fork! if Process.pid != @pid
       start_reporter
-      @aggregator.record_checkpoint(name: name, count: count)
+      @aggregator.record_checkpoint(name: name, count: count, context: context)
     rescue StandardError => e
       warn_once(:record_checkpoint, "DeployAngel failed to record a checkpoint: #{e.class}: #{e.message}")
     end
@@ -111,7 +135,7 @@ module DeployAngel
       return 0 unless @active
 
       @aggregator.drain(include_current: include_current, max_periods: config.max_queued_payloads).each do |period|
-        @buffer.push(Transport.encode(Protocol.telemetry(period, instance: @instance, release: @release,
+        @buffer.push(Transport.encode(Protocol.telemetry(period, instance: @instance, release: release,
           runtime: @runtime, capabilities: capabilities)))
       end
       send_buffered
@@ -160,7 +184,7 @@ module DeployAngel
       return if @metadata_sent || @metadata.nil? || paused?
 
       base = { "protocol_version" => Protocol::VERSION, "instance" => @instance.to_protocol,
-               "release" => @release.to_protocol, "runtime" => @runtime }.merge(@metadata.to_protocol)
+               "release" => release.to_protocol, "runtime" => @runtime }.merge(@metadata.to_protocol)
       result = @transport.post(METADATA_PATH, base)
       return unless result.ok?
 
@@ -185,6 +209,10 @@ module DeployAngel
       end
 
       def run_reporter
+        # Off the request path, so a process that exits within a minute or two
+        # doesn't build the fingerprint at shutdown instead. Only once the
+        # framework has attached the metadata it's built from.
+        release if @metadata
         until @stopping
           sleep(seconds_until_next_flush)
           break if @stopping
@@ -240,6 +268,18 @@ module DeployAngel
         @paused_until && @clock.call < @paused_until
       end
 
+      def warn_about_release
+        return unless @active
+
+        if @release.unknown?
+          warn_once(:unknown_release, "DeployAngel could not determine the release; set DEPLOYANGEL_REVISION " \
+            "or enable Heroku dyno metadata. Telemetry will not be attributed to deployments.")
+        elsif @release.source == "code_fingerprint"
+          warn_once(:code_fingerprint, "DeployAngel identifies releases by a fingerprint of the app's code. " \
+            "Set DEPLOYANGEL_REVISION to the deployed commit to see each release's commits and pull requests.")
+        end
+      end
+
       def warn_once(key, message)
         return if @warned[key]
 

data/lib/deployangel/cli.rb

@@ -33,7 +33,8 @@ module DeployAngel
         exception  Details for a fingerprint     deployangel exception FINGERPRINT
         check      Report a smoke test result    --name=NAME --status=pass|fail [--covers=a,b]
                                                  [--commit=SHA | --deployment=ID] [--details-url=URL]
-        install    Add a deploy hook             deployangel install kamal
+        install    Add a Kamal deploy hook, or    deployangel install kamal
+                   bake the commit into an image  deployangel install docker
         mcp        Run the MCP server over stdio (for coding agents)
 
       With no target, verify, plan, and check use the current git HEAD commit.
@@ -57,6 +58,25 @@ module DeployAngel
       bundle exec deployangel release || true
     SH
 
+    # Goes at the end of the Dockerfile's last stage: a value that changes
+    # with every commit invalidates the cache of every layer after it.
+    DOCKER_BUILD_HELP = <<~HELP.chomp
+      Pass the commit when you build the image:
+
+        docker build --build-arg GIT_SHA=$(git rev-parse HEAD) .
+        fly deploy --build-arg GIT_SHA=$(git rev-parse HEAD)
+        GitHub Actions (docker/build-push-action):
+          build-args: GIT_SHA=${{ github.sha }}
+
+      Kamal apps don't need this: DeployAngel reads Kamal's KAMAL_VERSION.
+    HELP
+
+    DOCKERFILE_LINES = <<~DOCKERFILE
+      # The commit this image runs, for DeployAngel. Build with --build-arg GIT_SHA=$(git rev-parse HEAD).
+      ARG GIT_SHA
+      ENV DEPLOYANGEL_REVISION=$GIT_SHA
+    DOCKERFILE
+
     def initialize(argv, env: ENV, stdin: $stdin, stdout: $stdout, stderr: $stderr, client: nil,
                    sleeper: ->(seconds) { sleep(seconds) }, clock: -> { Time.now }, git_head: nil, root: Dir.pwd)
       @root = root
@@ -206,12 +226,17 @@ module DeployAngel
         0
       end
 
-      # Writes .kamal/hooks/post-deploy, or says what to add to a hook that
-      # already exists, rather than overwriting it.
       def install
-        target = @argv.shift
-        return usage_error("install needs a target: deployangel install kamal") unless target == "kamal"
+        case (target = @argv.shift)
+        when "kamal" then install_kamal
+        when "docker" then install_docker
+        else usage_error("install needs a target: deployangel install kamal, or deployangel install docker")
+        end
+      end
 
+      # Writes .kamal/hooks/post-deploy, or says what to add to a hook that
+      # already exists, rather than overwriting it.
+      def install_kamal
         relative = File.join(".kamal", "hooks", "post-deploy")
         path = File.join(@root, relative)
         if File.exist?(path)
@@ -231,6 +256,55 @@ module DeployAngel
         0
       end
 
+      # Adds DEPLOYANGEL_REVISION, from a GIT_SHA build arg, to the Dockerfile.
+      # It never edits CI workflows; it says what to pass instead.
+      def install_docker
+        path = File.join(@root, "Dockerfile")
+        unless File.file?(path)
+          @stderr.puts("deployangel: no Dockerfile in #{@root}; run this where your Dockerfile is")
+          return USAGE_ERROR
+        end
+
+        content = File.read(path)
+        if content.include?("DEPLOYANGEL_REVISION")
+          @stdout.puts("Dockerfile already sets DEPLOYANGEL_REVISION.")
+          return 0
+        end
+
+        File.write(path, with_revision(content))
+        @stdout.puts("Added DEPLOYANGEL_REVISION to the Dockerfile's last stage. #{DOCKER_BUILD_HELP}")
+        0
+      end
+
+      # Before the CMD and ENTRYPOINT lines that end the last stage, with any
+      # comment just above them, or at the end if the stage doesn't end with
+      # one. Continuation lines aren't instructions.
+      def with_revision(content)
+        lines = content.lines
+        instructions = []
+        continuing = false
+        lines.each_with_index do |line, index|
+          text = line.strip
+          next if text.empty? || text.start_with?("#")
+
+          instructions << [ index, text[/\A\w+/].to_s.upcase ] unless continuing
+          continuing = text.end_with?("\\")
+        end
+
+        stage = instructions.drop(instructions.rindex { |_, word| word == "FROM" } || 0)
+        trailing = stage.reverse.take_while { |_, word| %w[CMD ENTRYPOINT].include?(word) }
+        if trailing.empty?
+          lines[-1] = "#{lines[-1].chomp}\n" if lines.any?
+          lines << "\n" unless lines.empty? || lines[-1].strip.empty?
+          lines << DOCKERFILE_LINES
+        else
+          at = trailing.last.first
+          at -= 1 while at.positive? && lines[at - 1].strip.start_with?("#")
+          lines.insert(at, DOCKERFILE_LINES)
+        end
+        lines.join
+      end
+
       def mcp
         require_relative "mcp"
         MCP::Server.new(client: client, input: @stdin, output: @stdout, error_output: @stderr,

data/lib/deployangel/core/aggregator.rb

@@ -37,6 +37,20 @@ module DeployAngel
       end
     end
 
+    # count: every recording; http and job: those recorded while handling an
+    # HTTP request or running a job (see ExecutionContext). The rest were
+    # recorded outside either.
+    CheckpointStats = Struct.new(:count, :http, :job) do
+      def record(count, context)
+        self.count += count
+        if context == ExecutionContext::HTTP
+          self.http += count
+        elsif context == ExecutionContext::JOB
+          self.job += count
+        end
+      end
+    end
+
     class Period
       attr_reader :started_at, :requests, :status_counts, :unhandled_exceptions, :histogram, :routes,
         :jobs, :job_classes, :exceptions, :exceptions_truncated, :checkpoints
@@ -52,13 +66,13 @@ module DeployAngel
         @job_classes = {}
         @exceptions = {}
         @exceptions_truncated = 0
-        @checkpoints = Hash.new(0)
+        @checkpoints = {}
       end
 
       # Up to 100 names per period; the rest are counted together.
-      def record_checkpoint(name, count)
+      def record_checkpoint(name, count, context)
         key = @checkpoints.key?(name) || @checkpoints.size < MAX_CHECKPOINTS - 1 ? name : OTHER_ROUTE
-        @checkpoints[key] += count
+        (@checkpoints[key] ||= CheckpointStats.new(0, 0, 0)).record(count, context)
       end
 
       # Up to 20 fingerprints per period; the rest are only counted.
@@ -141,9 +155,11 @@ module DeployAngel
       @mutex.synchronize { (@periods[started_at] ||= Period.new(started_at)).record_discard(job_class.to_s, @max_routes) }
     end
 
-    def record_checkpoint(name:, count: 1)
+    # context: where it was recorded, ExecutionContext::HTTP, ExecutionContext::JOB,
+    # or nil for neither.
+    def record_checkpoint(name:, count: 1, context: nil)
       started_at = period_start(@clock.call)
-      @mutex.synchronize { (@periods[started_at] ||= Period.new(started_at)).record_checkpoint(name, count) }
+      @mutex.synchronize { (@periods[started_at] ||= Period.new(started_at)).record_checkpoint(name, count, context) }
     end
 
     # A representative backtrace is kept only the first time this process

data/lib/deployangel/core/execution_context.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module DeployAngel
+  # The unit of work the current fiber is running: HTTP while the request
+  # middleware handles a request, JOB while job instrumentation runs a job,
+  # and nil otherwise (console, rake tasks, boot, a thread of the app's own).
+  # Checkpoints read it to say where they were recorded.
+  #
+  # Thread.current[] is fiber-local, like Rails' isolated execution state, so
+  # requests served concurrently in threads (Puma) or fibers (Falcon) each
+  # see their own. Every integration restores the previous value when its
+  # unit ends, even when it raises, so the innermost unit wins when they nest
+  # (a job performed inline during a request), and nothing leaks into the
+  # next request a reused thread serves.
+  module ExecutionContext
+    KEY = :__deployangel_execution_context
+    HTTP = :http
+    JOB = :job
+
+    module_function
+
+    def current
+      Thread.current[KEY]
+    end
+
+    # Returns the previous context, to hand back to restore.
+    def enter(kind)
+      previous = Thread.current[KEY]
+      Thread.current[KEY] = kind
+      previous
+    end
+
+    def restore(previous)
+      Thread.current[KEY] = previous
+    end
+  end
+end

data/lib/deployangel/core/protocol.rb

@@ -34,7 +34,11 @@ module DeployAngel
         "exceptions_truncated" => period.exceptions_truncated,
         "jobs" => job_stats(period.jobs),
         "job_classes" => period.job_classes.map { |key, stats| { "key" => key }.merge(job_stats(stats)) },
-        "checkpoints" => period.checkpoints.map { |key, count| { "key" => key, "count" => count } }
+        # http and job are always sent, 0 when none, so the cloud can tell
+        # this agent from one that doesn't say where checkpoints happened.
+        "checkpoints" => period.checkpoints.map do |key, stats|
+          { "key" => key, "count" => stats.count, "http" => stats.http, "job" => stats.job }
+        end
       }
     end
 

data/lib/deployangel/core/release.rb

@@ -13,9 +13,15 @@ module DeployAngel
     # Tags that move from build to build, so they can't identify a release.
     MOVING_TAGS = %w[latest main master production prod staging stable release].freeze
 
+    # Look for .git this many directories above the app's root, for an app
+    # that lives in a subdirectory of its repository.
+    GIT_PARENT_LEVELS = 3
+
     # Order: explicit configuration, Heroku dyno metadata, the hosting
     # platform's own variables (Kamal, Render, Fly.io, Railway, Coolify, and
-    # Dokku's GIT_REV), a REVISION file, then ECS container metadata.
+    # Dokku's GIT_REV), a REVISION file, a git checkout, then ECS container
+    # metadata. When none of them names the release, the agent falls back to
+    # a fingerprint of the app's code (code_fingerprint), computed later.
     def self.resolve(config:, env: ENV, root: nil, http: method(:fetch_metadata))
       if present?(config.release_version) || present?(config.revision)
         build(config.release_version, config.revision, "config")
@@ -36,6 +42,8 @@ module DeployAngel
         build(nil, env["GIT_REV"], "git_rev")
       elsif root && File.file?(revision_path = File.join(root, "REVISION"))
         build(nil, File.read(revision_path, 100), "revision_file")
+      elsif root && (commit = git_head(root))
+        build(nil, commit, "git_head")
       elsif present?(env["ECS_CONTAINER_METADATA_URI_V4"]) && (release = ecs(http.call(env["ECS_CONTAINER_METADATA_URI_V4"])))
         release
       else
@@ -73,6 +81,77 @@ module DeployAngel
       tag unless tag.empty?
     end
 
+    # A server deployed by `git pull` (or Fabric, or Ansible) runs from a
+    # checkout, where HEAD names the commit. Read from the repository's
+    # files, never by running git. Nil if anything is missing or unreadable.
+    def self.git_head(root)
+      git_dir = find_git_dir(File.expand_path(root)) or return
+      common_dir = git_dir
+      commondir = File.join(git_dir, "commondir")
+      common_dir = File.expand_path(File.read(commondir, 1024).strip, git_dir) if File.file?(commondir)
+
+      head = File.read(File.join(git_dir, "HEAD"), 200).to_s.strip
+      ref = head.delete_prefix("ref:").strip if head.start_with?("ref:")
+      commit = ref ? read_ref(ref, git_dir, common_dir) : head
+      commit = commit.to_s.strip.downcase
+      commit if commit.match?(COMMIT_FORMAT)
+    rescue StandardError
+      nil
+    end
+
+    # .git is a directory, or for a worktree or submodule, a file naming the
+    # real one ("gitdir: ../.git/worktrees/shop").
+    def self.find_git_dir(dir)
+      (GIT_PARENT_LEVELS + 1).times do
+        git = File.join(dir, ".git")
+        return File.directory?(git) ? git : linked_git_dir(git) if File.exist?(git)
+
+        parent = File.dirname(dir)
+        return if parent == dir
+
+        dir = parent
+      end
+      nil
+    end
+
+    def self.linked_git_dir(file)
+      path = File.read(file, 1024).to_s[/\Agitdir:\s*(.+)$/, 1]&.strip
+      File.expand_path(path, File.dirname(file)) if present?(path)
+    end
+
+    # A branch's commit is in its ref file, in the worktree's own git dir or
+    # the common one, or else in packed-refs. Refs come from a file on disk,
+    # so anything outside refs/ is ignored rather than read.
+    def self.read_ref(ref, git_dir, common_dir)
+      return unless ref.start_with?("refs/") && !ref.include?("..")
+
+      [ git_dir, common_dir ].uniq.each do |dir|
+        path = File.join(dir, ref)
+        return File.read(path, 100) if File.file?(path)
+      end
+
+      packed = File.join(common_dir, "packed-refs")
+      return unless File.file?(packed)
+
+      File.foreach(packed) do |line|
+        next if line.start_with?("#", "^")
+
+        commit, name = line.split(" ", 2)
+        return commit if name.to_s.strip == ref
+      end
+      nil
+    end
+
+    # The release of an app that names it no other way: the hash of the file
+    # digests the agent already sends (Metadata#file_manifest), so the same
+    # code gives the same release. None when digests are off or truncated.
+    def self.code_fingerprint(manifest)
+      return unless manifest.is_a?(Hash) && !manifest["truncated"] && manifest["count"].to_i.positive?
+
+      hash = manifest["hash"].to_s
+      build("code:#{hash[0, 12]}", nil, "code_fingerprint") if hash.match?(/\A\h{12}/)
+    end
+
     # ECS (Fargate, and EC2 with a recent agent) serves each container's
     # metadata at ECS_CONTAINER_METADATA_URI_V4. The image tag identifies the
     # release, and is the commit when it looks like one. A moving tag such

data/lib/deployangel/metadata.rb

@@ -167,6 +167,8 @@ module DeployAngel
       end
     end
 
+    # Built once per process, by the reporter: the metadata send and the
+    # code fingerprint (Release.code_fingerprint) both read it.
     def file_manifest
       @file_manifest ||= begin
         if @config.file_digests
@@ -180,9 +182,9 @@ module DeployAngel
         else
           { "hash" => nil, "count" => 0, "truncated" => false, "files" => {} }
         end
+      rescue StandardError
+        { "hash" => nil, "count" => 0, "truncated" => false, "files" => {} }
       end
-    rescue StandardError
-      { "hash" => nil, "count" => 0, "truncated" => false, "files" => {} }
     end
   end
 end

data/lib/deployangel/rack/http.rb

@@ -31,11 +31,16 @@ module DeployAngel
 
         started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         Redaction.request_host = env["HTTP_HOST"]
+        # Checkpoints recorded from here until the app returns count as
+        # recorded in a request.
+        previous_context = ExecutionContext.enter(ExecutionContext::HTTP)
         begin
           status, headers, body = @app.call(env)
         rescue Exception => e # rubocop:disable Lint/RescueException -- recorded, then re-raised untouched
           record(env, 500, started, unhandled: true, exception: e)
           raise
+        ensure
+          ExecutionContext.restore(previous_context)
         end
         # A framework that renders an exception itself swallows it before it
         # reaches this middleware, and renders some as 4xx; only those that

data/lib/deployangel/rails/active_job.rb

@@ -11,6 +11,34 @@ module DeployAngel
     # perform finishes.
     module ActiveJob
       STATE = :@__deployangel_job_state
+      PREVIOUS_CONTEXT = :@__deployangel_previous_context
+
+      # Marks the fiber as running a job for as long as perform.active_job
+      # lasts, so checkpoints recorded by the job say so. ActiveSupport calls
+      # finish from an ensure, so the previous context (an HTTP request, for
+      # a job performed inline) comes back even when the job raises. It is
+      # kept on the job, so only a perform that started here restores.
+      module ContextListener
+        module_function
+
+        def start(_name, _id, payload)
+          job = payload[:job]
+          return unless job && DeployAngel.recording?
+
+          job.instance_variable_set(PREVIOUS_CONTEXT, ExecutionContext.enter(ExecutionContext::JOB))
+        rescue StandardError
+          nil
+        end
+
+        def finish(_name, _id, payload)
+          job = payload[:job]
+          return unless job&.instance_variable_defined?(PREVIOUS_CONTEXT)
+
+          ExecutionContext.restore(job.remove_instance_variable(PREVIOUS_CONTEXT))
+        rescue StandardError
+          nil
+        end
+      end
 
       module_function
 
@@ -23,6 +51,7 @@ module DeployAngel
         subscribe("enqueue_retry.active_job") { |payload| state(payload).merge!(failed: true, error: payload[:error]) }
         subscribe("discard.active_job") { |payload| state(payload).merge!(failed: true, discarded: true, error: payload[:error]) }
         subscribe("retry_stopped.active_job") { |payload| state(payload).merge!(failed: true, discarded: true, error: payload[:error]) }
+        ::ActiveSupport::Notifications.subscribe("perform.active_job", ContextListener)
         ::ActiveSupport::Notifications.subscribe("perform.active_job") { |event| record(event) }
       end
 

data/lib/deployangel/sidekiq.rb

@@ -16,12 +16,15 @@ module DeployAngel
 
         started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         latency = DeployAngel::Sidekiq.queue_latency_ms(job)
+        previous_context = ExecutionContext.enter(ExecutionContext::JOB)
         begin
           yield
         rescue Exception => e # rubocop:disable Lint/RescueException -- recorded, then re-raised untouched
           DeployAngel.record_exception(e, source: "job_class:#{job["class"]}")
           record(job, started, latency, failed: true)
           raise
+        ensure
+          ExecutionContext.restore(previous_context)
         end
         record(job, started, latency, failed: false)
       end

data/lib/deployangel/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DeployAngel
-  VERSION = "0.1.14"
+  VERSION = "0.1.16"
 end

data/lib/deployangel.rb

@@ -9,6 +9,7 @@ require_relative "deployangel/core/release"
 require_relative "deployangel/core/instance"
 require_relative "deployangel/core/aggregator"
 require_relative "deployangel/core/protocol"
+require_relative "deployangel/core/execution_context"
 require_relative "deployangel/core/buffer"
 require_relative "deployangel/core/transport"
 require_relative "deployangel/agent"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: deployangel
 version: !ruby/object:Gem::Version
-  version: 0.1.14
+  version: 0.1.16
 platform: ruby
 authors:
 - Jordan Owens
@@ -38,6 +38,7 @@ files:
 - lib/deployangel/configuration.rb
 - lib/deployangel/core/aggregator.rb
 - lib/deployangel/core/buffer.rb
+- lib/deployangel/core/execution_context.rb
 - lib/deployangel/core/fingerprint.rb
 - lib/deployangel/core/histogram.rb
 - lib/deployangel/core/instance.rb