Map ports in mobymask-v2 and apps stacks to localhost (#439)

* Fixes for repos checked out from a tag rather than a branch

* Fix happy path

app/data/compose/docker-compose-lasso.yml

@@ -0,0 +1,8 @@
+version: "3.2"
+
+services:
+  lasso:
+    image: cerc/lasso:local
+    restart: always
+    ports:
+      - "0.0.0.0:3000:3000"

app/data/compose/docker-compose-mobymask-app.yml

@@ -23,7 +23,7 @@ services:
       - peers_ids:/peers
       - mobymask_deployment:/server
     ports:
-      - "0.0.0.0:3002:80"
+      - "127.0.0.1:3002:80"
     healthcheck:
       test: ["CMD", "nc", "-vz", "localhost", "80"]
       interval: 20s
@@ -55,7 +55,7 @@ services:
       - peers_ids:/peers
       - mobymask_deployment:/server
     ports:
-      - "0.0.0.0:3004:80"
+      - "127.0.0.1:3004:80"
     healthcheck:
       test: ["CMD", "nc", "-vz", "localhost", "80"]
       interval: 20s

app/data/compose/docker-compose-peer-test-app.yml

@@ -18,7 +18,7 @@ services:
       - ../config/watcher-mobymask-v2/test-app-start.sh:/scripts/test-app-start.sh
       - peers_ids:/peers
     ports:
-      - "0.0.0.0:3003:80"
+      - "127.0.0.1:3003:80"
     healthcheck:
       test: ["CMD", "nc", "-v", "localhost", "80"]
       interval: 20s

app/data/compose/docker-compose-watcher-mobymask-v2.yml

@@ -14,7 +14,7 @@ services:
       - ../config/postgresql/multiple-postgressql-databases.sh:/docker-entrypoint-initdb.d/multiple-postgressql-databases.sh
       - mobymask_watcher_db_data:/var/lib/postgresql/data
     ports:
-      - "0.0.0.0:15432:5432"
+      - "127.0.0.1:15432:5432"
     healthcheck:
       test: ["CMD", "nc", "-v", "localhost", "5432"]
       interval: 20s
@@ -95,9 +95,9 @@ services:
       - mobymask_deployment:/server
     # Expose GQL, metrics and relay node ports
     ports:
-      - "0.0.0.0:3001:3001"
-      - "0.0.0.0:9001:9001"
-      - "0.0.0.0:9090:9090"
+      - "127.0.0.1:3001:3001"
+      - "127.0.0.1:9001:9001"
+      - "127.0.0.1:9090:9090"
     healthcheck:
       test: ["CMD", "busybox", "nc", "localhost", "9090"]
       interval: 20s

app/data/config/watcher-mobymask-v2/mobymask-params.env

@@ -10,7 +10,7 @@ DEFAULT_CERC_RELAY_PEERS=[]
 DEFAULT_CERC_RELAY_ANNOUNCE_DOMAIN=
 
 # Base URI for mobymask-app (used for generating invite)
-DEFAULT_CERC_MOBYMASK_APP_BASE_URI="http://127.0.0.1:3002/#"
+DEFAULT_CERC_MOBYMASK_APP_BASE_URI="http://127.0.0.1:3004/#"
 
 # Set to false for disabling watcher peer to send txs to L2
 DEFAULT_CERC_ENABLE_PEER_L2_TXS=true

app/data/container-build/cerc-lasso/build.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# Build the lasso image
+source ${CERC_CONTAINER_BASE_DIR}/build-base.sh
+docker build -t cerc/lasso:local -f ${CERC_REPO_BASE_DIR}/lasso/Dockerfile ${build_command_args} ${CERC_REPO_BASE_DIR}/lasso

app/data/container-image-list.txt

@@ -42,3 +42,4 @@ cerc/ipld-eth-state-snapshot
 cerc/watcher-gelato
 cerc/lotus
 cerc/go-opera
+cerc/lasso

app/data/pod-list.txt

@@ -29,3 +29,4 @@ watcher-azimuth
 watcher-gelato
 fixturenet-lotus
 mainnet-go-opera
+lasso

app/data/repository-list.txt

@@ -35,3 +35,4 @@ github.com/cerc-io/gelato-watcher-ts
 github.com/filecoin-project/lotus
 git.vdb.to/cerc-io/test-project
 github.com/Fantom-foundation/go-opera
+github.com/cerc-io/lasso

app/data/stacks/fixturenet-optimism/README.md

@@ -42,12 +42,11 @@ Deploy the stack:
 laconic-so --stack fixturenet-optimism deploy up
 ```
 
-If you get the error `service "fixturenet-optimism-contracts" didn't complete successfully: exit 1` with ~25 lines of Traceback, wait 15-20 mins then re-run the command.
-
 The `fixturenet-optimism-contracts` service takes a while to complete running as it:
 1. waits for the 'Merge' to happen on L1
 2. waits for a finalized block to exist on L1 (so that it can be taken as a starting block for roll ups)
 3. deploys the L1 contracts
+It may restart a few times after running into errors.
 
 To list and monitor the running containers:
 
@@ -115,6 +114,5 @@ docker volume rm $(docker volume ls -q --filter "name=.*l1_deployment|.*l2_accou
 
 ## Known Issues
 
-* `fixturenet-eth` currently starts fresh on a restart
 * Resource requirements (memory + time) for building the `cerc/foundry` image are on the higher side
   * `cerc/optimism-contracts` image is currently based on `cerc/foundry` (Optimism requires foundry installation)

app/data/stacks/lasso/README.md

@@ -0,0 +1,7 @@
+# lasso
+
+```
+laconic-so --stack lasso setup-repositories
+laconic-so --stack lasso build-containers 
+laconic-so --stack lasso deploy up
+```

app/data/stacks/lasso/stack.yml

@@ -0,0 +1,8 @@
+version: "0.1"
+name: lasso
+repos:
+  - github.com/cerc-io/lasso
+containers:
+  - cerc/lasso
+pods:
+  - lasso

app/data/stacks/mobymask-v2/README.md

@@ -31,17 +31,21 @@ Deploy the stack:
 * Deploy the containers:
 
   ```bash
-  laconic-so --stack mobymask-v2 deploy-system up
+  laconic-so --stack mobymask-v2 deploy --cluster mobymask_v2 up
   ```
 
-* List and check the health status of all the containers using `docker ps` and wait for them to be `healthy`
+  NOTE: The `fixturenet-optimism-contracts` service takes a while to run to completion and it may restart a few times after running into errors.
 
-  NOTE: The `mobymask-app` container might not start; if the app is not running at http://localhost:3002, restart the container using it's id:
+* To list down and monitor the running containers:
 
   ```bash
-  docker ps -a | grep "mobymask-app"
+  laconic-so --stack mobymask-v2 deploy --cluster mobymask_v2 ps
 
-  docker restart <CONTAINER_ID>
+  # With status
+  docker ps -a
+
+  # Check logs for a container
+  docker logs -f <CONTAINER_ID>
   ```
 
 ## Tests
@@ -68,11 +72,12 @@ docker ps | grep -E 'mobymask-app|peer-test-app'
 
 ### mobymask-app
 
-The mobymask-app should be running at http://localhost:3002
+* The mobymask-app should be running at http://localhost:3002
+* The lxdao-mobymask-app should be running at http://localhost:3004
 
 ### peer-test-app
 
-The peer-test-app should be running at http://localhost:3003
+* The peer-test-app should be running at http://localhost:3003
 
 ## Details
 
@@ -91,15 +96,15 @@ Follow the [demo](./demo.md) to try out the MobyMask app with L2 chain
 Stop all the services running in background run:
 
 ```bash
-laconic-so --stack mobymask-v2 deploy-system down 30
+laconic-so --stack mobymask-v2 deploy --cluster mobymask_v2 down 30
 ```
 
 Clear volumes created by this stack:
 
 ```bash
 # List all relevant volumes
-docker volume ls -q --filter "name=.*mobymask_watcher_db_data|.*peers_ids|.*mobymask_deployment|.*l1_deployment|.*l2_accounts|.*l2_config|.*l2_geth_data"
+docker volume ls -q --filter "name=mobymask_v2"
 
 # Remove all the listed volumes
-docker volume rm $(docker volume ls -q --filter "name=.*mobymask_watcher_db_data|.*peers_ids|.*mobymask_deployment|.*l1_deployment|.*l2_accounts|.*l2_config|.*l2_geth_data")
+docker volume rm $(docker volume ls -q --filter "name=mobymask_v2")
 ```

app/data/stacks/mobymask-v2/demo.md

@@ -9,23 +9,23 @@
   The invite link is seen at the end of the logs. Example log:
 
   ```bash
-  laconic-bfb01caf98b1b8f7c8db4d33f11b905a-mobymask-1  | http://127.0.0.1:3002/#/members?invitation=%7B%22v%22%3A1%2C%22signedDelegations%22%3A%5B%7B%22signature%22%3A%220x7559bd412f02677d60820e38243acf61547f79339395a34f7d4e1630e645aeb30535fc219f79b6fbd3af0ce3bd05132ad46d2b274a9fbc4c36bc71edd09850891b%22%2C%22delegation%22%3A%7B%22delegate%22%3A%220xc0838c92B2b71756E0eAD5B3C1e1F186baeEAAac%22%2C%22authority%22%3A%220x0000000000000000000000000000000000000000000000000000000000000000%22%2C%22caveats%22%3A%5B%7B%22enforcer%22%3A%220x558024C7d593B840E1BfD83E9B287a5CDad4db15%22%2C%22terms%22%3A%220x0000000000000000000000000000000000000000000000000000000000000000%22%7D%5D%7D%7D%5D%2C%22key%22%3A%220x98da9805821f1802196443e578fd32af567bababa0a249c07c82df01ecaa7d8d%22%7D
+  http://127.0.0.1:3004/#/members?invitation=%7B%22v%22%3A1%2C%22signedDelegations%22%3A%5B%7B%22signature%22%3A%220x7559bd412f02677d60820e38243acf61547f79339395a34f7d4e1630e645aeb30535fc219f79b6fbd3af0ce3bd05132ad46d2b274a9fbc4c36bc71edd09850891b%22%2C%22delegation%22%3A%7B%22delegate%22%3A%220xc0838c92B2b71756E0eAD5B3C1e1F186baeEAAac%22%2C%22authority%22%3A%220x0000000000000000000000000000000000000000000000000000000000000000%22%2C%22caveats%22%3A%5B%7B%22enforcer%22%3A%220x558024C7d593B840E1BfD83E9B287a5CDad4db15%22%2C%22terms%22%3A%220x0000000000000000000000000000000000000000000000000000000000000000%22%7D%5D%7D%7D%5D%2C%22key%22%3A%220x98da9805821f1802196443e578fd32af567bababa0a249c07c82df01ecaa7d8d%22%7D
   ```
 
 * Open the invite link in a browser to use the mobymask-app.
 
-  NOTE: Before opening the invite link, clear the browser cache (local storage) for http://127.0.0.1:3002 to remove old invitations
+  NOTE: Before opening the invite link, clear the browser cache (local storage) for http://127.0.0.1:3004 to remove old invitations
 
 * In the debug panel, check if it is connected to the p2p network (it should be connected to at least one other peer for pubsub to work).
 
-* Create an invite link in the app by clicking on `Create new invite link` button.
+* Create an invite link in the app by clicking on `Create new invite link` button in the `My invitees` section.
 
 * Switch to the `MESSAGES` tab in debug panel for viewing incoming messages later.
 
 * Open the invite link in a new browser with different profile (to simulate remote browser)
-  * Check that it is connected to any other peer in the network.
+  * Check that it is connected to a peer in the network.
 
-* In `Report a phishing attempt` section, report multiple phishers using the `Submit` button. Click on the `Submit batch to p2p network` button. This broadcasts signed invocations to the connected peers.
+* In the `Pending reports` section, enter multiple phisher records and click on the `Submit batch to p2p network` button. This broadcasts signed invocations to the connected peers.
 
 * In the `MESSAGES` tab of other browsers, a message can be seen with the signed invocations.
 
@@ -66,7 +66,7 @@
   * Get the deployed contract address:
 
     ```bash
-    docker exec -it $(docker ps -aq --filter name="mobymask-app") cat /config/config.yml
+    docker exec -it $(docker ps -aq --filter name="lxdao-mobymask-app") cat /config/config.yml
     ```
 
     The value of `address` field is the deployed contract address
@@ -91,15 +91,14 @@
   * Watcher internally is using L2 chain `eth_getStorageAt` method.
 
 * Check the phisher name in mobymask app in `Check Phisher Status` section.
-    * Watcher GQL API is used for checking phisher.
+  * Watcher GQL API is used for checking phisher.
 
-* Manage the invitations by clicking on the `Outstanding Invitations in p2p network`.
-
-* Revoke the created invitation by clicking on `Revoke (p2p network)`
+* Manage invitations in the `Outstanding invitations (p2p network)` tab in `My Invitations` section.
+  * Revoke the created invitation by clicking on the `Revoke` button.
 
 * Revocation messages can be seen in the debug panel `MESSAGES` tab of other browsers.
 
-* Check the watcher peer logs. It should receive a message and log the transaction receipt for a `revoke` message.
+* Also, check the watcher peer logs. It should receive a message and log the transaction receipt for a `revoke` message.
 
 * Try reporting a phisher from the revoked invitee's browser.
 

app/data/stacks/mobymask-v2/mobymask-only.md

@@ -49,7 +49,7 @@ Create and update an env file to be used in the next step ([defaults](../../conf
 
   # Base URI for mobymask-app
   # (used for generating a root invite link after deploying the contract)
-  CERC_MOBYMASK_APP_BASE_URI="http://127.0.0.1:3002/#"
+  CERC_MOBYMASK_APP_BASE_URI="http://127.0.0.1:3004/#"
 
   # (Optional) Domain to be used in the relay node's announce address
   CERC_RELAY_ANNOUNCE_DOMAIN=
@@ -72,16 +72,16 @@ Create and update an env file to be used in the next step ([defaults](../../conf
 ### Deploy the stack
 
 ```bash
-laconic-so --stack mobymask-v2 deploy --include watcher-mobymask-v2 --env-file <PATH_TO_ENV_FILE> up
+laconic-so --stack mobymask-v2 deploy --cluster mobymask_v2 --include watcher-mobymask-v2 --env-file <PATH_TO_ENV_FILE> up
 ```
 
 To list down and monitor the running containers:
 
 ```bash
-laconic-so --stack mobymask-v2 deploy --include watcher-mobymask-v2 ps
+laconic-so --stack mobymask-v2 deploy --cluster mobymask_v2 --include watcher-mobymask-v2 ps
 
 # With status
-docker ps
+docker ps -a
 
 # Check logs for a container
 docker logs -f <CONTAINER_ID>
@@ -108,15 +108,15 @@ For deploying the web-app(s) separately after deploying the watcher, follow [web
 Stop all services running in the background:
 
 ```bash
-laconic-so --stack mobymask-v2 deploy --include watcher-mobymask-v2 down
+laconic-so --stack mobymask-v2 deploy --cluster mobymask_v2 --include watcher-mobymask-v2 down
 ```
 
 Clear volumes created by this stack:
 
 ```bash
 # List all relevant volumes
-docker volume ls -q --filter "name=.*mobymask_watcher_db_data|.*peers_ids|.*mobymask_deployment"
+docker volume ls -q --filter "name=mobymask_v2"
 
 # Remove all the listed volumes
-docker volume rm $(docker volume ls -q --filter "name=.*mobymask_watcher_db_data|.*peers_ids|.*mobymask_deployment")
+docker volume rm $(docker volume ls -q --filter "name=mobymask_v2")
 ```

app/data/stacks/mobymask-v2/watcher-p2p-network/watcher.md

@@ -110,8 +110,8 @@ To list down and monitor the running containers:
   # Expected output:
 
   # Running containers:
-  # id: 25cc3a1cbda27fcd9c2ad4c772bd753ccef1e178f901a70e6ff4191d4a8684e9, name: mobymask_v2-mobymask-watcher-db-1, ports: 0.0.0.0:15432->5432/tcp
-  # id: c9806f78680d68292ffe942222af2003aa3ed5d5c69d7121b573f5028444391d, name: mobymask_v2-mobymask-watcher-server-1, ports: 0.0.0.0:3001->3001/tcp, 0.0.0.0:9001->9001/tcp, 0.0.0.0:9090->9090/tcp
+  # id: 25cc3a1cbda27fcd9c2ad4c772bd753ccef1e178f901a70e6ff4191d4a8684e9, name: mobymask_v2-mobymask-watcher-db-1, ports: 127.0.0.1:15432->5432/tcp
+  # id: c9806f78680d68292ffe942222af2003aa3ed5d5c69d7121b573f5028444391d, name: mobymask_v2-mobymask-watcher-server-1, ports: 127.0.0.1:3001->3001/tcp, 127.0.0.1:9001->9001/tcp, 127.0.0.1:9090->9090/tcp
   # id: 6b30a1d313a88fb86f8a3b37a1b1a3bc053f238664e4b2d196c3ec74e04faf13, name: mobymask_v2-peer-tests-1, ports:
 
 
@@ -122,8 +122,8 @@ To list down and monitor the running containers:
 
   # CONTAINER ID   IMAGE                            COMMAND                  CREATED         STATUS                   PORTS                                                                    NAMES
   # 6b30a1d313a8   cerc/watcher-ts:local            "docker-entrypoint.s…"   5 minutes ago   Up 4 minutes                                                                                      mobymask_v2-peer-tests-1
-  # c9806f78680d   cerc/watcher-mobymask-v2:local   "sh start-server.sh"     5 minutes ago   Up 5 minutes (healthy)   0.0.0.0:3001->3001/tcp, 0.0.0.0:9001->9001/tcp, 0.0.0.0:9090->9090/tcp   mobymask_v2-mobymask-watcher-server-1
-  # 25cc3a1cbda2   postgres:14-alpine               "docker-entrypoint.s…"   5 minutes ago   Up 5 minutes (healthy)   0.0.0.0:15432->5432/tcp                                                  mobymask_v2-mobymask-watcher-db-1
+  # c9806f78680d   cerc/watcher-mobymask-v2:local   "sh start-server.sh"     5 minutes ago   Up 5 minutes (healthy)   127.0.0.1:3001->3001/tcp, 127.0.0.1:9001->9001/tcp, 127.0.0.1:9090->9090/tcp   mobymask_v2-mobymask-watcher-server-1
+  # 25cc3a1cbda2   postgres:14-alpine               "docker-entrypoint.s…"   5 minutes ago   Up 5 minutes (healthy)   127.0.0.1:15432->5432/tcp                                                  mobymask_v2-mobymask-watcher-db-1
 
 
   # Check logs for a container

app/data/stacks/mobymask-v2/watcher-p2p-network/web-app.md

@@ -78,7 +78,7 @@ To monitor the running container:
   # Expected output:
 
   # CONTAINER ID   IMAGE                    COMMAND                  CREATED         STATUS                   PORTS                  NAMES
-  # f1369dbae1c9   cerc/mobymask-ui:local   "docker-entrypoint.s…"   2 minutes ago   Up 2 minutes (healthy)   0.0.0.0:3004->80/tcp   mm_v2-lxdao-mobymask-app-1
+  # f1369dbae1c9   cerc/mobymask-ui:local   "docker-entrypoint.s…"   2 minutes ago   Up 2 minutes (healthy)   127.0.0.1:3004->80/tcp   mm_v2-lxdao-mobymask-app-1
 
   # Check logs for a container
   docker logs -f mm_v2-lxdao-mobymask-app-1

app/data/stacks/mobymask-v2/web-apps.md

@@ -47,14 +47,14 @@ Create and update an env file to be used in the next step ([defaults](../../conf
 
 For running mobymask-app
 ```bash
-laconic-so --stack mobymask-v2 deploy --include mobymask-app --env-file <PATH_TO_ENV_FILE> up
+laconic-so --stack mobymask-v2 deploy --cluster mobymask_v2 --include mobymask-app --env-file <PATH_TO_ENV_FILE> up
 
 # Runs mobymask-app on host port 3002 and lxdao-mobymask-app on host port 3004
 ```
 
 For running peer-test-app
 ```bash
-laconic-so --stack mobymask-v2 deploy --include peer-test-app --env-file <PATH_TO_ENV_FILE> up
+laconic-so --stack mobymask-v2 deploy --cluster mobymask_v2 --include peer-test-app --env-file <PATH_TO_ENV_FILE> up
 
 # Runs on host port 3003
 ```
@@ -62,9 +62,10 @@ laconic-so --stack mobymask-v2 deploy --include peer-test-app --env-file <PATH_T
 To list down and monitor the running containers:
 
 ```bash
-laconic-so --stack mobymask-v2 deploy --include [mobymask-app | peer-test-app] ps
+laconic-so --stack mobymask-v2 deploy --cluster mobymask_v2 --include [mobymask-app | peer-test-app] ps
 
-docker ps
+# With status
+docker ps -a
 
 # Check logs for a container
 docker logs -f <CONTAINER_ID>
@@ -80,20 +81,20 @@ Stop all services running in the background:
 
 For mobymask-app
 ```bash
-laconic-so --stack mobymask-v2 deploy --include mobymask-app down
+laconic-so --stack mobymask-v2 deploy --cluster mobymask_v2 --include mobymask-app down
 ```
 
 For peer-test-app
 ```bash
-laconic-so --stack mobymask-v2 deploy --include peer-test-app down
+laconic-so --stack mobymask-v2 deploy --cluster mobymask_v2 --include peer-test-app down
 ```
 
 Clear volumes created by this stack:
 
 ```bash
 # List all relevant volumes
-docker volume ls -q --filter "name=.*mobymask_deployment|.*peers_ids"
+docker volume ls -q --filter "name=mobymask_v2"
 
 # Remove all the listed volumes
-docker volume rm $(docker volume ls -q --filter "name=.*mobymask_deployment|.*peers_ids")
+docker volume rm $(docker volume ls -q --filter "name=mobymask_v2")
 ```

app/setup_repositories.py

@@ -69,8 +69,26 @@ def host_and_path_for_repo(fully_qualified_repo):
             return repo_host_split[0], "/".join(repo_host_split[1:]), repo_branch
 
 
+# See: https://stackoverflow.com/questions/18659425/get-git-current-branch-tag-name
+def _get_repo_current_branch_or_tag(full_filesystem_repo_path):
+    current_repo_branch_or_tag = "***UNDETERMINED***"
+    is_branch = False
+    try:
+        current_repo_branch_or_tag = git.Repo(full_filesystem_repo_path).active_branch.name
+        is_branch = True
+    except TypeError as error:
+        # This means that the current ref is not a branch, so possibly a tag
+        # Let's try to get the tag
+        current_repo_branch_or_tag = git.Repo(full_filesystem_repo_path).git.describe("--tags", "--exact-match")
+        # Note that git is assymetric -- the tag you told it to check out may not be the one
+        # you get back here (if there are multiple tags associated with the same commit)
+    return current_repo_branch_or_tag, is_branch
+
+
 # TODO: fix the messy arg list here
 def process_repo(verbose, quiet, dry_run, pull, check_only, git_ssh, dev_root_path, branches_array, fully_qualified_repo):
+    if verbose:
+        print(f"Processing repo: {fully_qualified_repo}")
     repo_host, repo_path, repo_branch = host_and_path_for_repo(fully_qualified_repo)
     git_ssh_prefix = f"git@{repo_host}:"
     git_http_prefix = f"https://{repo_host}/"
@@ -78,9 +96,9 @@ def process_repo(verbose, quiet, dry_run, pull, check_only, git_ssh, dev_root_pa
     repoName = repo_path.split("/")[-1]
     full_filesystem_repo_path = os.path.join(dev_root_path, repoName)
     is_present = os.path.isdir(full_filesystem_repo_path)
-    current_repo_branch = git.Repo(full_filesystem_repo_path).active_branch.name if is_present else None
+    (current_repo_branch_or_tag, is_branch) = _get_repo_current_branch_or_tag(full_filesystem_repo_path) if is_present else (None, None)
     if not quiet:
-        present_text = f"already exists active branch: {current_repo_branch}" if is_present \
+        present_text = f"already exists active {'branch' if is_branch else 'tag'}: {current_repo_branch_or_tag}" if is_present \
             else 'Needs to be fetched'
         print(f"Checking: {full_filesystem_repo_path}: {present_text}")
     # Quick check that it's actually a repo
@@ -93,9 +111,12 @@ def process_repo(verbose, quiet, dry_run, pull, check_only, git_ssh, dev_root_pa
                 if verbose:
                     print(f"Running git pull for {full_filesystem_repo_path}")
                 if not check_only:
-                    git_repo = git.Repo(full_filesystem_repo_path)
-                    origin = git_repo.remotes.origin
-                    origin.pull(progress=None if quiet else GitProgress())
+                    if is_branch:
+                        git_repo = git.Repo(full_filesystem_repo_path)
+                        origin = git_repo.remotes.origin
+                        origin.pull(progress=None if quiet else GitProgress())
+                    else:
+                        print(f"skipping pull because this repo checked out a tag")
                 else:
                     print("(git pull skipped)")
     if not is_present:
@@ -122,14 +143,15 @@ def process_repo(verbose, quiet, dry_run, pull, check_only, git_ssh, dev_root_pa
         branch_to_checkout = repo_branch
 
     if branch_to_checkout:
-        if current_repo_branch is None or (current_repo_branch and (current_repo_branch != branch_to_checkout)):
+        if current_repo_branch_or_tag is None or (current_repo_branch_or_tag and (current_repo_branch_or_tag != branch_to_checkout)):
             if not quiet:
                 print(f"switching to branch {branch_to_checkout} in repo {repo_path}")
             git_repo = git.Repo(full_filesystem_repo_path)
+            # git checkout works for both branches and tags
             git_repo.git.checkout(branch_to_checkout)
         else:
             if verbose:
-                print(f"repo {repo_path} is already switched to branch {branch_to_checkout}")
+                print(f"repo {repo_path} is already on branch/tag {branch_to_checkout}")
 
 
 def parse_branches(branches_string):