deploy:cleanup can delete the active release when a deploy fails

[RubenGVOnestic]

Deployer version: 8.0.5

Hi everyone! I'm trying to cleanup the releases after a failed deploy and i'm expenting this issue:

Bug description

When a deploy fails, the deploy:cleanup task runs via:

after('deploy:failed', 'deploy:cleanup');

This hook is not part of Deployer's default flow — we added it explicitly to our recipe to clean up orphaned release directories on failure. However, it introduces a race condition: deploy:cleanup can delete the currently active release if it is not the most recently created one, leaving the current symlink pointing to a non-existent directory and taking down the site.

Root cause

deploy:cleanup keeps the last N releases ordered by creation time (releases_list, newest first) and blindly deletes the rest. It has no awareness of which release current is pointing to.

In a successful deploy this is safe because deploy:cleanup always runs inside deploy:publish, after deploy:symlink has already updated current to the newest release (index 0):

deploy:release → new release added as index 0 in releases_list
deploy:symlink → current → newest release (index 0)
deploy:cleanup → keeps index 0…N-1, current is always index 0 ✅

In a failed deploy the sequence breaks:

deploy:release → failed release added as index 0: [failed, ..., active_current]
... fails before deploy:symlink ...
deploy:cleanup → keep_releases=1: keeps index 0 (the failed dir)
deletes everything else, including active_current ❌
current symlink now points to a deleted directory → site down

Deployer's default behavior on failure is to leave the orphaned release directory in place and let the next successful deploy clean it up safely (after deploy:symlink has run). Our custom hook bypasses this safety guarantee.

Affected configuration

• keep_releases = 1 (non-production) / 3 (production)
• The after('deploy:failed', 'deploy:cleanup') hook added

The risk is higher in non-production environments (keep_releases=1) since any active release not at index 0 is immediately deleted.

Proposed fix

task('deploy:cleanup', function () {
  $releases = get('releases_list');
  $keep = get('keep_releases');
  $sudo = get('cleanup_use_sudo') ? 'sudo' : '';

  run("cd {{deploy_path}} && if [ -e release ]; then rm release; fi");

  if ($keep <= 0) {
      return;
  }

  $currentRelease = null;
  if (test('[ -h {{current_path}} ]')) {
      $currentRelease = basename(run('readlink {{current_path}}'));
  }

  foreach (array_slice($releases, $keep) as $release) {
      if ($release === $currentRelease) {
          writeln("<comment>Skipping current release $release (active but outside keep window)</comment>");
          continue;
      }
      run("$sudo rm -rf {{deploy_path}}/releases/$release");
  }
});