Making a bullet-proof Git checkout in our CD job - bash

Question

The simplified story is that we have a site installed on multiple servers (e.g QA, Prod).
Git is set to another branch/tag for every environment, and we have deployment scripts that are generic for all environments to make things simple. The scripts are getting the desired branch/tag and then run the following commands:
GIT_CHECKOUT="${1:-develop}"
git clean --force --quiet
git fetch --all
git pull --all
git checkout $GIT_CHECKOUT
We have a few issues with that:
Since we want to support both branch and tags we use both git pull and git fetch and git pull fails on the detached head mode, that works but it throws irrelevant errors to our logs
Sometimes checkout fails because of a dirty environment (usually it happens without us knowing what caused it in the first place since no one changed files manually on those environments)
I took a look on the way Jenkins do it and it looks something like that:
> git fetch --tags --progress https://myrepo.com/repo.git +refs/heads/*:refs/remotes/origin/*
> git rev-parse origin/mytag^{commit}
> git rev-parse mytag^{commit}
> git config core.sparsecheckout
> git checkout -f hash-of-commit
> git rev-list --no-walk hash-of-commit
Finally, the questions:
Should we work only in detached head mode when deploying? It does sound like a more stable solution.
Is there a "recipe" for that task? It is a very common task, and despite that, I couldn't find any online recipe to do it with your own bash script

Answer 1

It makes sense that on 'detached HEAD' you get an error when trying pull... because pull uses the upstream branch to merge... if you are on detached HEAD, you won't have an upstream branch. Doing git fetch should be enough to update the remote information on the local. If you really want to do checkout and don't want to care for if you have a dirty environment or not, you might try gir reset --hard instead.
This is what I would do:
git clean --force --quiet
git fetch --all
git checkout --detach # disconnect from whatever branch I was working on
git reset --hard $GIT_CHECKOUT
The only thing is that you are not moving anything locally (no local branches are moving with the remote branches, for example).

Answer 2

My take would be this (untested):
GIT_CHECKOUT="${1:-develop}"
# cleanup *every* untracked file and dir
git clean --force -d -x --quiet
# undo every change to untracked files - might disturb update
git reset --hard HEAD
# now the working tree should be *pristine*
# update all tracking branches and tags
git fetch --all --tags
git checkout --detach
# delete any local branch
git for-each-ref --format="%(refname:strip=2)" refs/heads |xargs -r git branch -D
# checkout
git checkout $GIT_CHECKOUT