Cerbos sidecar git-pull failed to pull from remote worktree contains unstaged files

TL;DR

For "Failed to pull from remote": policy updates stop being pulled into the PDP. The checkout directory contains unstaged content, usually inherited from the source git repository itself (e.g. a.gitignore added later or stray files committed in history), the underlying git library cannot pull over it.

Failed to pull from remote

Steps

1. The Cerbos sidecar (git-pull) fails refreshing git-based policies with: "Failed to pull from remote", worktree contains unstaged files. Policy updates stop being pulled into the PDP.
2. The checkout directory contains unstaged content, usually inherited from the source git repository itself (e.g. a .gitignore added later or stray files committed in history), the underlying git library cannot pull over it. Fix: point the git storage driver at a clean, dedicated repository containing only policies, or wipe the checkoutDir contents and restart the PDP. The reporter verified a fresh policy repo restored automatic reloads.

When to use

You are seeing this: The Cerbos sidecar (git-pull) fails refreshing git-based policies with: "Failed to pull from remote", worktree contains unstaged files. Use this skill when you run into "Cerbos sidecar git-pull failed to pull from remote worktree contains unstaged files".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

The thread asked: The Cerbos sidecar (git-pull) fails refreshing git-based policies with: "Failed to pull from remote", worktree contains unstaged files. Policy updates stop being pulled into the PDP.

The verified answer: The checkout directory contains unstaged content, usually inherited from the source git repository itself (e.g. a .gitignore added later or stray files committed in history), the underlying git library cannot pull over it. Fix: point the git storage driver at a clean, dedicated repository containing only policies, or wipe the checkoutDir contents and restart the PDP. The reporter verified a fresh policy repo restored automatic reloads.

Thread: https://vectle.com/threads/thr_uKVkEU9Gsl4SsBJw-mkx4A