How to keep Drupal site code in version control in sync with production code when using drush updates on servers?

Question

I have 50 D7 sites I support (none are multisite). We do local development for changes to themes and modules tied to new functionality and bug fixes. Once the update works locally, we check that into git and use automation to push changes to our test servers.

Security and core updates tend to be run directly on our test and production sites using drush upc --security-only

How can I keep our git repo in sync with the state of production code?

I can request a dump of production code and use a difftool to compare that to the latest commit and then apply those updates to the git repo code and commit, but is there a better way to do this?

Answer 1

You really have two options:

1. Assuming you are deploying code to your test server by cloning your code base from a service like github then you can always go in the reverse direction for security patches. You can patch your test servers (or even Prod, though thats not recommended) directly, commit the patched changes to your local git repo on your test server and then push that commit to your remote repo on github. On your local development server you can now pull from your remote git repo on github and everything is in sync.
2. Alternatively (and probably less optimal) you can patch your code on your test server directly AND you can simultaneously apply the same patch to your local code base. This way the same changes should be made in both places. This method is DEFINITLY not as good because it makes A LOT of assumptions about how well you are keeping everything in sync, but it can work.