fix deploy commit resolver fetch path

scripts/src/deploy.ts

@@ -82,6 +82,7 @@ interface ServiceRuntimeState {
 
 const defaultDeployFile = "deploy.json";
 const defaultTimeoutMs = 900_000;
+const resolveFetchTimeout = "120s";
 const shortDispatchWaitMs = 25_000;
 const shortRemoteTimeoutMs = 20_000;
 const pollIntervalMs = 5_000;
@@ -199,6 +200,17 @@ function candidateRepoUrls(repo: string): string[] {
   return [...new Set(urls)];
 }
 
+function localResolvedCommitForDesired(desired: DeployManifestService): string | null {
+  const desiredSlug = repoSlug(desired.repo);
+  if (desiredSlug === null || desired.commitId.length !== 40) return null;
+  const localOrigin = runCommand(["git", "remote", "get-url", "origin"], repoRoot);
+  const localOriginUrl = localOrigin.exitCode === 0 ? localOrigin.stdout.trim() : "";
+  if (localOriginUrl.length === 0 || repoSlug(localOriginUrl) !== desiredSlug) return null;
+  const resolved = runCommand(["git", "rev-parse", "--verify", `${desired.commitId}^{commit}`], repoRoot);
+  const fullCommit = parseFullCommit(resolved.stdout);
+  return resolved.exitCode === 0 && fullCommit === desired.commitId.toLowerCase() ? fullCommit : null;
+}
+
 function commandFailure(result: ReturnType<typeof runCommand>, maxChars = 1200): string {
   const detail = [result.stderr, result.stdout].filter(Boolean).join("\n");
   return compactTail(detail, maxChars) || `exit ${result.exitCode}`;
@@ -210,7 +222,14 @@ function runGitOrThrow(args: string[], cwd: string, message: string): ReturnType
   return result;
 }
 
+function runResolveGit(args: string[], cwd: string): ReturnType<typeof runCommand> {
+  return runCommand(["timeout", resolveFetchTimeout, "git", ...args], cwd);
+}
+
 function resolveDesiredCommit(desired: DeployManifestService): DeployManifestService {
+  const localCommit = localResolvedCommitForDesired(desired);
+  if (localCommit !== null) return { ...desired, commitId: localCommit };
+
   const cacheDir = repoResolveCacheDir(desired.repo);
   mkdirSync(cacheDir, { recursive: true });
   if (!existsSync(join(cacheDir, ".git", "config"))) {
@@ -228,17 +247,33 @@ function resolveDesiredCommit(desired: DeployManifestService): DeployManifestSer
       fetchErrors.push(`${repoUrl}: ${commandFailure(addRemote)}`);
       continue;
     }
-    const fetch = runCommand([
-      "git",
-      "-C",
-      cacheDir,
-      "fetch",
-      "--no-tags",
-      "--prune",
-      "origin",
-      "+refs/heads/*:refs/remotes/origin/*",
-      "+refs/tags/*:refs/tags/*",
-    ], repoRoot);
+    const fetches = desired.commitId.length === 40
+      ? [
+        runResolveGit(["-C", cacheDir, "fetch", "--no-tags", "--depth=1", "origin", desired.commitId], repoRoot),
+        runResolveGit([
+          "-C",
+          cacheDir,
+          "fetch",
+          "--no-tags",
+          "--prune",
+          "origin",
+          "+refs/heads/*:refs/remotes/origin/*",
+          "+refs/tags/*:refs/tags/*",
+        ], repoRoot),
+      ]
+      : [
+        runResolveGit([
+          "-C",
+          cacheDir,
+          "fetch",
+          "--no-tags",
+          "--prune",
+          "origin",
+          "+refs/heads/*:refs/remotes/origin/*",
+          "+refs/tags/*:refs/tags/*",
+        ], repoRoot),
+      ];
+    const fetch = fetches.find((result) => result.exitCode === 0) ?? fetches[fetches.length - 1];
     if (fetch.exitCode === 0) {
       fetchErrors.length = 0;
       break;