I have 50 D7 sites I support (none are multisite). We do local development for changes to themes and modules tied to new functionality and bug fixes. Once the update works locally, we check that into git and use automation to push changes to our test servers.
Security and core updates tend to be run directly on our test and production sites using drush upc --security-only
How can I keep our git repo in sync with the state of production code?
I can request a dump of production code and use a difftool to compare that to the latest commit and then apply those updates to the git repo code and commit, but is there a better way to do this?