Tracking Exactly What's Deployed: Git Commits and Deploy History

The problem this solves

An image tag used to carry only a timestamp — neo-shop:20260818-045536. Two deploys of different commits looked identical; redeploying the same commit looked like a new version. There was no way to answer "which code is actually running?" short of guessing from a clock.

What gets captured

Every deploy now reads the local git commit, branch, tag, and whether the tree was dirty, and tags the image accordingly:

neo-shop:20260818-045536-a1b2c3d

neo list

NAME    DOMAIN              STATUS      VERSION
● shop  shop.example.com    running     v1.4.2 (a1b2c3d)

One app in full detail

neo status shop

Shows the commit, branch, image, who deployed it and when, plus its domains and containers — the one place that shows everything about a single app, where neo list truncates and plain neo status only covers the server.

The full history

neo deploys shop

Recorded server-side in /etc/neo/deploys/<app>.jsonl, append-only — so it's shared by every machine that deploys, including CI, and survives a fresh git clone. Entries whose image has since been pruned are marked, since those specific builds can no longer be restored.

Inside the container

neo run shop -- printenv | grep NEO_GIT

NEO_GIT_COMMIT=a1b2c3d4e5f6...
NEO_GIT_SHORT_COMMIT=a1b2c3d

These are injected before .neo.yml interpolation runs, so you can wire them anywhere without Neo knowing what tool you're feeding:

env:
  SENTRY_RELEASE: "${NEO_GIT_COMMIT}"

Checking a deploy actually landed, from CI

[ "$(neo status shop --json | jq -r .deployment.commit)" = "$GITHUB_SHA" ] || exit 1