From 69189797df959ac5c4e2385afd2af1119afffbb0 Mon Sep 17 00:00:00 2001
From: Prashant Vasudevan <71649489+vprashrex@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:20:45 +0530
Subject: [PATCH 1/2] fix(deployment): Restore user env in production SSM
 deploy

SSM AWS-RunShellScript runs as root without HOME set, so the first
command (git config --global) failed with "fatal: $HOME not set" and
blocked every production release. Restore what #292 dropped and what
deploy-staging.yml still does: export HOME for the deploy user, load
NVM, and restart pm2 as that user.

Closes #298
---
 .github/workflows/create-release.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index f54ef26..7bc5184 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -57,17 +57,22 @@ jobs:
           APP_NAME: ${{ secrets.PM2_APP_NAME }}
           AWS_REGION: ${{ secrets.AWS_REGION }}
           INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
+          ROOT_USER: ${{ secrets.USER }}
           DEPLOY_SHA: ${{ github.sha }}
         run: |
           : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"
+          : "${ROOT_USER:?USER secret is not set}"
 
-          REMOTE_CMD="git config --global --add safe.directory $BUILD_DIRECTORY \
+          REMOTE_CMD="export HOME=/home/$ROOT_USER \
+            && export NVM_DIR=/home/$ROOT_USER/.nvm \
+            && . \$NVM_DIR/nvm.sh \
+            && git config --global --add safe.directory $BUILD_DIRECTORY \
             && cd $BUILD_DIRECTORY \
             && git fetch origin --tags --prune \
             && git checkout $DEPLOY_SHA \
             && npm ci \
             && npm run build \
-            && pm2 restart $APP_NAME"
+            && sudo -iu $ROOT_USER pm2 restart $APP_NAME"
 
           # Build the parameters as JSON so quoting in REMOTE_CMD can't break it.
           PARAMS=$(jq -n --arg cmd "$REMOTE_CMD" '{commands: [$cmd]}')

From 087c06d001300e3fc9014232612f3f1d3b46573e Mon Sep 17 00:00:00 2001
From: Prashant Vasudevan <71649489+vprashrex@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:25:25 +0530
Subject: [PATCH 2/2] fix(deployment): Run production deploy as root with HOME
 set

Per review, keep the deploy running as root and set HOME=/root so
git config --global works, instead of switching to the deploy user.
Drop the ROOT_USER env, NVM setup and sudo pm2 restart.
---
 .github/workflows/create-release.yml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 7bc5184..eee02d5 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -57,22 +57,18 @@ jobs:
           APP_NAME: ${{ secrets.PM2_APP_NAME }}
           AWS_REGION: ${{ secrets.AWS_REGION }}
           INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
-          ROOT_USER: ${{ secrets.USER }}
           DEPLOY_SHA: ${{ github.sha }}
         run: |
           : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"
-          : "${ROOT_USER:?USER secret is not set}"
 
-          REMOTE_CMD="export HOME=/home/$ROOT_USER \
-            && export NVM_DIR=/home/$ROOT_USER/.nvm \
-            && . \$NVM_DIR/nvm.sh \
+          REMOTE_CMD="export HOME=/root \
             && git config --global --add safe.directory $BUILD_DIRECTORY \
             && cd $BUILD_DIRECTORY \
             && git fetch origin --tags --prune \
             && git checkout $DEPLOY_SHA \
             && npm ci \
             && npm run build \
-            && sudo -iu $ROOT_USER pm2 restart $APP_NAME"
+            && pm2 restart $APP_NAME"
 
           # Build the parameters as JSON so quoting in REMOTE_CMD can't break it.
           PARAMS=$(jq -n --arg cmd "$REMOTE_CMD" '{commands: [$cmd]}')